sudo & the sudoers File: Borrowing Root's Powers

On Linux you almost never log in as root. It's too dangerous to sit as the all-powerful user all day, one typo and you've wiped the system. Instead you stay a normal user and, for the few commands that truly need it, you borrow root's powers for a moment with sudo. This lesson is how sudo works, and how the sudoers file decides who's allowed to do what.

What sudo is

sudo means "superuser do". It runs one command as another user, root by default, then immediately drops you back to being yourself:

sudo apt update              # run apt update as root
sudo systemctl restart ssh   # restart a service as root

The first time you use it, sudo asks for your own password (not root's), confirms you're allowed, then remembers you for a few minutes so you're not retyping it constantly.

The everyday sudo commands

sudo <command>          run one command as root
sudo -l                 list what YOU are allowed to run with sudo
sudo -u bob <command>   run the command as user 'bob' (not root)
sudo -i    (or sudo su) open a full root shell, use sparingly
sudo -k                 forget the cached password right now

Memorise sudo -l. It prints exactly which commands you may run, and as whom. It's the first thing to check on any machine you land on, admin or attacker.

Where the rules live: /etc/sudoers

Who can use sudo, and for what, is written in /etc/sudoers (plus extra files in /etc/sudoers.d/).

Never open it in a normal text editor. One typo can lock everyone out of sudo, including you. Always edit it with:

sudo visudo

visudo opens the file, and when you save it checks the syntax first and refuses to write a broken file. That safety net is the entire reason it exists.

Reading a sudoers rule

Every user rule has the same four-part shape:

who      where = (as_whom)      what

Here's a full-power example:

alice    ALL = (ALL:ALL)        ALL

Read it left to right:

• alice , the user this rule is about.
• ALL (where) , on all hosts. Only matters for configs shared across machines; usually just ALL.
• (ALL:ALL) (as whom) , alice may run commands as any user and any group.
• ALL (what) , any command.

So that line means "alice can run any command as anyone", full admin. Now compare a tightly scoped rule:

bob      ALL = (root)           /usr/bin/systemctl restart nginx

bob may run only systemctl restart nginx, and only as root. Nothing else at all. That's least privilege: hand out exactly the one power a person needs, and no more.

The pieces you'll actually see

Groups, written with %. A name starting with % is a group, so the rule covers every member:

%sudo    ALL=(ALL:ALL) ALL          # everyone in the 'sudo' group gets full sudo
%devs    ALL=(root) /usr/bin/systemctl restart app

On Ubuntu, "being an admin" literally means being in the sudo group, which is exactly that first line.

NOPASSWD. By default sudo prompts for your password. NOPASSWD: skips it for the listed commands:

carol    ALL=(root) NOPASSWD: /usr/bin/apt update

carol can run apt update as root with no prompt, convenient for automation, and risky if that command can be abused.

Run as a user other than root. The (as_whom) field doesn't have to be root:

deploy   ALL=(www-data) /usr/bin/git -C /var/www pull

deploy runs that git pull as the web user www-data, using sudo -u www-data ....

Aliases keep large files readable (just recognise them):

Cmnd_Alias SERVICES = /usr/bin/systemctl restart nginx, /usr/bin/systemctl restart ssh
%ops     ALL=(root) SERVICES

Putting it together: sudo -l

Once you can read a rule, sudo -l output makes complete sense:

$ sudo -l
User analyst may run the following commands on this host:
    (root) NOPASSWD: /usr/bin/systemctl restart nginx
    (root) /usr/bin/less /var/log/*

That says: you may restart nginx as root without a password, and read log files with less as root (with your password). Each line is one specific, granted power.

Where this leads: privilege escalation

A too-generous sudo rule is one of the most common paths from a normal user straight to root. If sudo -l shows you can run something like vim, less, find, or python as root, that program can usually be tricked into launching a root shell, the GTFOBins technique. So reading sudo -l isn't just admin housekeeping; it's the first move an attacker makes after landing on a box. You'll go deep on this in the Privilege Escalation lesson.

Try it (terminal)

1. sudo -l , see what you're allowed to run.
2. sudo cat /etc/sudoers , read the rulebook itself (it's root-only, so plain cat is denied).
3. sudo cat /etc/shadow , reach a root-only file through sudo.

Why this matters

sudo is how real administration gets done safely: stay an ordinary user, and borrow root only for the exact command that needs it. The sudoers file is the rulebook behind it, and reading a sudo rule fluently, who may run what, as whom , is a core Linux skill and the single most useful thing to check the moment you land on any system.