linux system-management

sudo

sudo root linux permissions privileges security
Plain English

sudo lets a normal user do one admin task at a time. Instead of logging in as the all-powerful root account, you put sudo in front of a command, type your own password, and that one command runs with full rights. It keeps day-to-day work safe and leaves a record of who did what. The name comes from “superuser do.”

Technical Definition

sudo runs a command as another user, root by default, according to rules in the sudoers policy. On Ubuntu the first user created at install is in the sudo group, and /etc/sudoers grants that group full access:

%sudo   ALL=(ALL:ALL) ALL

Read as: members of group sudo, on all hosts, may run as any user and group, any command.

Behavior:

  • Prompts for your password, not root’s. Ubuntu locks the root password by default.
  • Caches the credential for 15 minutes per terminal by default.
  • Logs every use to the journal (and /var/log/auth.log where rsyslog is installed).
  • Resets most environment variables for safety.

Useful forms:

  • sudo <cmd>: run one command as root
  • sudo -i: open a root login shell (use sparingly)
  • sudo -u postgres psql: run as a different user
  • sudo -l: list what you are allowed to run
  • sudoedit /etc/fstab: edit a root-owned file safely

Editing rules: always use visudo, which checks syntax before saving. A broken sudoers file can lock every admin out. Put custom rules in /etc/sudoers.d/.

Redirection gotcha: sudo echo x > /etc/file fails because your unprivileged shell opens the file. Use echo x | sudo tee /etc/file.

Source: sudo project manual

Everyday sudo 

# Install packages
$ sudo apt update && sudo apt install htop

# What am I allowed to run?
$ sudo -l
User george may run the following commands on lab:
    (ALL : ALL) ALL

# Write to a root-owned file
$ echo "vm.swappiness=10" | sudo tee /etc/sysctl.d/99-swap.conf

# Give a user admin rights, then they must log out and back in
$ sudo usermod -aG sudo alex

# Recent sudo activity
$ journalctl _COMM=sudo --since today
In the Wild

sudo is how admin work gets done on almost every Linux server. Good practice is least privilege: grant specific commands in /etc/sudoers.d/ instead of full root, use groups instead of per-user rules, and never add NOPASSWD: ALL to an account that faces the internet. Security teams watch sudo logs because a misconfigured rule, such as letting a user run vim or find as root, is a classic privilege escalation path. If you find yourself typing sudo before every command, stop and check whether you actually need it; most file work in your home folder does not.

← Back to Dictionary