What sudo access means and why you might need it

Sudo is the tool that lets a regular user run commands as if they were the system administrator, without giving them the administrator password. When you add someone to the sudoers file, you are saying: "This person can run certain commands with full system power, but only after typing their own password."

You might need to do this if you share a Linux computer with someone else, or if you are setting up a machine for a colleague or family member who needs to install software, change settings, or manage system files. The person who can use sudo is not the same as the person who owns the machine — they just have permission to do certain powerful things.

The sudoers file is a special configuration file that lives in /etc/sudoers. It is the only safe way to give someone sudo access. Never edit it with a regular text editor, because a mistake in that file can lock you out of your own machine. Always use the visudo command instead, which checks your work before saving.

Key Takeaways

  • Use the visudo command to edit the sudoers file — never open /etc/sudoers directly in a text editor.
  • The simplest way to add a user is to add them to the sudo group (on Ubuntu and Debian) or the wheel group (on Fedora and Red Hat), which gives them full sudo access.
  • You must already have sudo access yourself to add someone else to sudoers.
  • After you make the change, the user should test it by opening a new terminal window and typing a command like sudo whoami to confirm it works.
  • If you make a mistake in the sudoers file, you can lock yourself out, so read the error message visudo shows you before saving.

How to add a user to the sudo group on Ubuntu or Debian

On Ubuntu and Debian systems, the easiest way to give someone sudo access is to add them to the sudo group. Open a terminal and type this command, replacing username with the actual login name of the person you want to add:

sudo usermod -aG sudo username

This command tells the system to add the user to the sudo group. The -a flag means "append" (add them without removing them from other groups), and -G means "to these groups". The user will have full sudo access as soon as they log out and log back in, or open a new terminal window.

You can check that it worked by asking the user to open a new terminal and type sudo whoami. They will be asked for their password, and if they type it correctly, the output will be root. If it says "user is not in the sudoers file", the change has not taken effect yet — ask them to log out completely and log back in.

How to add a user to the wheel group on Fedora or Red Hat

On Fedora, Red Hat, and CentOS systems, the group is called wheel instead of sudo. The command is the same, just with a different group name:

sudo usermod -aG wheel username

After you run this command, the user should log out and log back in. Then they can test it the same way: open a new terminal and type sudo whoami. If they see root as the output, it worked.

How to give sudo access for only specific commands

If you want to let someone run only certain commands with sudo — for example, only the ability to restart the web server or install updates — you need to edit the sudoers file directly with visudo. This is more complex, but it is much safer than giving someone full sudo access.

Open a terminal and type sudo visudo. This will open the sudoers file in a text editor. Scroll to the bottom of the file and add a line like this:

username ALL=(ALL) /usr/bin/systemctl restart nginx

This line says: "Let username run the command /usr/bin/systemctl restart nginx with sudo, on any machine (ALL), as any user (ALL)." You can add multiple commands by separating them with commas, or use a wildcard like /usr/bin/apt* to allow all commands that start with apt.

When you are done editing, press Ctrl+X (or the save command for your editor), and visudo will check your work. If there is a syntax error, it will show you the line number and ask if you want to fix it. Always fix errors before saving — a broken sudoers file can lock you out.

What to do if you make a mistake in the sudoers file

If you save a broken sudoers file, you will not be able to use sudo at all, even to fix it. The best way to prevent this is to use visudo every time — it checks your syntax before saving. If you do make a mistake and lock yourself out, you will need to restart the machine in single-user mode or use a live USB to fix the file.

If you are not comfortable with single-user mode, the safest approach is to add users to the sudo or wheel group instead of editing sudoers directly. That way, if something goes wrong, you can still boot normally and fix it.

How to remove sudo access from a user

If you need to take away someone's sudo access, use this command:

sudo deluser username sudo (on Ubuntu or Debian)

sudo deluser username wheel (on Fedora or Red Hat)

The user will lose sudo access the next time they log in. If they are already logged in, they can finish what they are doing, but they will not be able to run any new sudo commands.

Frequently Asked Questions

Do I need the administrator password to add someone to sudoers?

No. You need to already have sudo access yourself, which you prove by typing your own password when you run the sudo command. You do not need to know anyone else's password.

Can I give someone sudo access without them knowing?

Technically yes, but you should not. They will discover it the next time they try to run a command that requires admin power, or the next time they log in. It is better to tell them directly that they now have sudo access and show them how to use it responsibly.

What happens if someone types their password wrong when using sudo?

They will see an error message and can try again. After three wrong attempts, sudo will lock them out for a few minutes. This is a security feature to prevent someone from guessing passwords.

Can I give sudo access to a user who does not have a login account yet?

No. The user must have an account on the machine first. If you need to create a new account, use the useradd or adduser command, then add them to the sudo or wheel group.

Is it safe to give everyone on my computer sudo access?

It depends on who they are and what you trust them to do. Sudo access means they can install software, delete files, and change system settings. Only give it to people you trust completely. For shared computers with less trusted users, it is better to give them access to only the specific commands they need.