How to Add a User to Sudoers in Ubuntu

The quick fix: usermod -aG sudo

sudo usermod -aG sudo username

These are all the commands needed. On Ubuntu (and generally on Debian), there's a group called sudo, predefined to have all administrative rights in the /etc/sudoers file; adding an account to this group grants root access through sudo. For people coming from RHEL, Fedora or CentOS, it's the same technique but under another name; the corresponding group is called wheel.

The -a flag is not optional

While it may look like an optional one, it's not. Using usermod -G sudo username without -a will overwrite the group membership of the user with just sudo, effectively stripping off other groups such as docker, www-data or any other the user was part of before. The meaning of the -a flag is append; omitting it is fine only if you deliberately want to strip the user of all the other groups.

The new group membership requires a new session

An already logged-in user won't see the change, since group membership is loaded upon login and not changed during the session. An SSH connection needs to disconnect and connect back to take effect. Without a new login session, one of the following two commands in the current shell will add the new group membership:

newgrp sudo
su - username

Check if the change happened

groups username
sudo -l -U username

The first command lists all the groups that the account belongs to, checking for the presence of sudo in it. The second command gives a more specific information, showing the actual privileges the user gets; it's relevant when you need to use more than just group membership. The user should be instructed to type sudo whoami; a root answer means success; "is not in the sudoers file" error means failure.

A scoped alternative: a file in /etc/sudoers.d/

Sudo membership is an all or nothing thing: unrestricted root access with no restrictions. On a shared server, it's more than anyone needs. Adding a file to /etc/sudoers.d/ allows giving exactly the required privileges separately for each user:

sudo visudo -f /etc/sudoers.d/username

Example of granting full access: username ALL=(ALL:ALL) ALL. Example of giving a narrow privilege without password for a specific command is username ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx. In both cases, the file needs to be owned by root and have permissions 0440; otherwise sudo will not accept the configuration as valid. The /etc/sudoers file always includes this folder and ignores any file with a dot or a tilde in the name, so editor backups are not accepted as a valid configuration.

Never edit /etc/sudoers file with a normal text editor

While /etc/sudoers is a text file, it should never be edited with editors such as nano or vim. The visudo utility is designed for this purpose because a single typo made in this file renders all accounts unable to use sudo – including root.

According to the Debian manual for visudo, visudo edits a locked copy of the file and checks the syntax before saving it; if a problem is found, it rejects the change, giving an opportunity to fix it or cancel it. Editing this file without checking for syntax can put the system into a state where nobody can use any sudo command until the problem is fixed either in a root shell or using a rescue boot.

Syntax check without changing the file

To check the current state of the /etc/sudoers file and all files in /etc/sudoers.d/ without changing anything, use:

sudo visudo -c

It checks all the files that sudo uses and tells whether each of them parses successfully – handy to run after restoring the configuration from a backup or moving a sudoers.d file to another server, or just before exiting a session.

How to revoke sudo access

If the access was granted through the sudo group, then the access needs to be revoked using the same command as the granting one:

sudo gpasswd -d username sudo

Just as granting it, it doesn't affect an active session: even if the user is logged in now, he will have access until he logs off and logs back in, despite the group change being done. If access was granted via a sudoers.d file, then it can be easily removed by just deleting the corresponding file.

sudo rm /etc/sudoers.d/username

Using sudoers.d files has some advantages in multi-admin environments – each user's privileges are isolated, and the removal of the file cleanly removes the access. OrbitServers bare-metal servers give administrators full root access, which allows configuring the system as needed by security policies.