How to Give a User Permission to Run Commands as Administrator on Linux

What the sudoers file does and why you need it

The sudoers file is a configuration file on Linux systems that controls which users can run commands with administrator (root) privileges. When you add a username to this file, that user can run commands prefixed with sudo — which stands for "superuser do" — without needing the root password. Instead, they enter their own password to confirm the action.

You need to edit this file when you want to let another user on your system perform administrative tasks — installing software, restarting services, modifying system files — without giving them the root password itself. This is safer than sharing root access because you can limit exactly which commands each user is allowed to run, and the system logs every command they execute with sudo.

The sudoers file lives at /etc/sudoers on every Linux system. You should never edit it with a regular text editor. Instead, you use a special command called visudo, which checks your changes for errors before saving them. A syntax mistake in the sudoers file can lock you out of administrator access entirely, so visudo prevents that by validating the file first.

Key Takeaways

Always use the visudo command to edit the sudoers file, never a regular text editor like nano or vim.
The simplest entry to add a user is a single line: username ALL=(ALL) ALL, which lets that user run any command with sudo.
You must have root or sudo access yourself to edit the sudoers file — a regular user cannot make these changes.
After you save the file with visudo, the changes take effect when ready the next time that user runs a sudo command.
If you make a syntax error, visudo will warn you and let you fix it before the file is saved, preventing you from losing access.

Opening the sudoers file with visudo

Open a terminal on your Linux system. You must be logged in as root or as a user who already has sudo access. Type the following command and press Enter:

sudo visudo

The system will ask for your password (your own password, not the root password). Enter it and press Enter. The sudoers file will open in a text editor — usually vi or nano, depending on your system's default. The file contains comments (lines starting with #) that explain the syntax, and existing rules that control sudo access.

If you see an error message saying "visudo: command not found", your system may use a different path. Try sudo /usr/sbin/visudo instead. On most modern Linux distributions, visudo is in your system path and the first command works.

Finding the right place to add the new user

Scroll down through the file until you find a section that looks like this:

# User privilege specification root ALL=(ALL:ALL) ALL # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL

The line root ALL=(ALL:ALL) ALL shows the root user's permissions. Below that, you will usually see rules for groups (lines starting with %) or individual users. This is where you add your new user's line.

You can add the new user's line anywhere after the root line, but the clearest place is right after the root line or in a section labeled "User privilege specification". The order does not matter for functionality, but keeping related rules together makes the file easier to read later.

Adding the username with full sudo access

Position your cursor at the end of the line you want to insert after (for example, the root line). Press Enter to create a new line. Type the following, replacing username with the actual username:

username ALL=(ALL) ALL

This line means: the user named username can run any command on any host (the first ALL) as any user (the second ALL) with any group (the third ALL). In practice, this gives that user the same administrative power as root — they can run any command with sudo.

Make sure there are spaces (not tabs) between each part of the line. The format is strict: username, then spaces, then ALL=(ALL), then spaces, then ALL. If you use tabs instead of spaces, visudo may reject the line as invalid.

Saving the file and checking for errors

Once you have typed the new line, save the file. If you are using vi, press Escape, then type :wq and press Enter. If you are using nano, press Ctrl+O, press Enter to confirm the filename, then press Ctrl+X to exit.

Before the file is actually saved, visudo will check the syntax. If there are no errors, the file closes and you return to the terminal prompt. If visudo finds an error, it will display a message showing the line number and the problem. You will be asked whether you want to re-edit the file (press e) or discard your changes (press x). Choose e to fix the error, then save again.

The most common errors are using tabs instead of spaces, misspelling the username, or forgetting a required part of the line. If you see an error, read the message carefully — it usually points to the exact problem.

Testing that the user can now run sudo commands

Switch to the user account you just added to the sudoers file. You can do this by logging out and logging back in as that user, or by opening a new terminal window and typing:

su - username

The system will ask for that user's password. Enter it. Now you are logged in as that user. Type a straightforward command that requires sudo, such as:

sudo whoami

The system will ask for the user's password (not the root password). Enter it. If the command runs and prints root, the user now has sudo access. If you see a message like "user is not in the sudoers file", the entry did not save correctly — go back and check the syntax with visudo.

Limiting a user to specific commands instead of all commands

If you want the user to run only certain commands with sudo, rather than any command, you can replace ALL at the end with a list of specific commands. For example:

username ALL=(ALL) /usr/bin/systemctl, /usr/bin/apt-get

This line lets the user run only systemctl (to restart services) and apt-get (to install packages) with sudo. Any other command they try to run with sudo will be denied. You must use the full path to each command — /usr/bin/systemctl rather than just systemctl.

To find the full path to a command, type which commandname in the terminal. For example, which systemctl will show you the full path. Limiting commands is more find than giving full sudo access, especially if the user is less experienced or if you want to prevent accidental damage to the system.

Frequently Asked Questions

What happens if I make a mistake and lock myself out of sudo access?

If you have physical access to the machine, you can usually boot into recovery mode or single-user mode and fix the sudoers file. On most systems, hold Shift while the computer boots, select recovery mode from the menu, and you will have root access without needing sudo. Then run visudo again to correct the error. If you do not have physical access, you may need to contact your system administrator or the server provider.

Can I add a group to the sudoers file instead of individual users?

Yes. A line starting with % applies to a group instead of a user. For example, %developers ALL=(ALL) ALL gives sudo access to everyone in the developers group. This is useful when you have many users who should have the same permissions — you add them to the group once, and they automatically get sudo access.

Do I need to restart the system after editing the sudoers file?

No. The changes take effect when ready. The next time the user runs a sudo command, the system reads the updated sudoers file and applies the new rules. There is no need to restart the system or log out and back in, though logging out and back in will also work.

What is the difference between ALL=(ALL) and ALL=(ALL:ALL)?

The format ALL=(ALL:ALL) specifies both the user and group that the command can run as. The format ALL=(ALL) is a shorthand that means the same thing on most systems. Both are valid; the longer form is just more explicit. You will see both in existing sudoers files.

Can a user run sudo commands without entering their password?

Yes, but it is a security risk. Add NOPASSWD: before the command list, like this: username ALL=(ALL) NOPASSWD: ALL. This lets the user run any sudo command without a password. Use this only for automated scripts or trusted systems where the security trade-off is acceptable.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.