Manage Sudo Users in Linux: Add, Restrict & Remove Access

User administration is a key responsibility in Linux system operations. Administrators must carefully decide which accounts receive elevated privileges and how that access is controlled. A secure and flexible way to assign such rights is by adding users to the sudo group. The sudo (short for “superuser do”) command lets selected users run commands with elevated permissions, typically those of root, without logging in as root.

This guide explains how to grant elevated privileges by either assigning users to the sudo group or by adjusting sudo rules using the Linux Sudoers file.

Prerequisites

Access to a Linux machine as a non-root sudo user.

Matching infrastructure at centron

No hardware needed to follow along: ccloud³ VMs with full root access start at €3.12 per month, billed by the hour and ready in seconds. Rent a cloud server →

Adding Users to the Sudo Group

On most Linux systems, users in the sudo group receive administrative rights. This approach is safer than logging in as root directly, as it reduces the risk of accidental system-wide issues. On RHEL-based distributions (CentOS, Rocky Linux), the equivalent group is usually called wheel. In production setups, giving normal user accounts sudo privileges is best practice.

Administrators can add users to groups using the usermod command with the appropriate parameters. Follow the steps below to create and configure users with sudo rights.

Verify Logged-in User

[pdm_code_snippet background="no" background-mobile="no" slim="yes" line-numbers="yes" bg-color="#abb8c3" theme="dark" language="php" wrapped="yes" height="" copy-text="Copy Code" copy-confirmed="Copied"]

$ whoami

Sample output:

linuxuser

Check Current Sudo Privileges

$ sudo -l

Example result:

Matching Defaults entries for linuxuser on LinuxWorkstation:
    env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin, use_pty

User linuxuser may run the following commands on LinuxWorkstation:
    (ALL) NOPASSWD: ALL

This indicates that the account linuxuser can run any command without being prompted for a password. The command is useful for auditing user permissions.

Create a New User

$ sudo adduser john

You will be asked to set a password and provide user details. Example system messages:

info: Adding user `john' ...
info: Adding new group `john' ...
info: Creating home directory `/home/john' ...
passwd: password updated successfully
Changing the user information for john
Full Name []: john wick
Room Number []: 1234
Work Phone []: 9876543210
Home Phone []: 1234567890
Other []: 
Is the information correct? [Y/n] Y

Note: By default, Linux assigns users to a primary group matching their username and sometimes a secondary users group. These defaults do not include sudo rights.

Check if a User Has Sudo Rights

$ sudo -U john -l

Typical result:

User john is not allowed to run sudo on LinuxWorkstation.

Grant Sudo Access

$ sudo usermod -aG sudo john

Switch to the User and Test

$ sudo su - john

Once logged in as john, test with:

$ sudo whoami

Expected output:

root

View Members of the Sudo Group

Using getent

$ getent group sudo

Sample output:

sudo:x:27:john,jane

Using groups

$ groups jane

Output:

jane : jane sudo users

Similarly for john:

$ groups john

Output:

john : john sudo users

Restricting Access with the Sudoers File

The /etc/sudoers file should only be modified with visudo to avoid syntax errors. While sudo group membership grants wide privileges, the sudoers file lets administrators restrict or tailor commands available to each user.

Define Allowed Commands

Edit the sudoers configuration for a specific user:

$ sudo visudo -f /etc/sudoers.d/john

Define an alias for commands:

Cmnd_Alias UPDATE_AND_UPGRADE = /usr/bin/apt update, /usr/bin/apt upgrade

Grant access without password prompts:

john ALL=(ALL) NOPASSWD: UPDATE_AND_UPGRADE

Or grant access to a single command:

john ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx

Verify Custom Rules

Switch to john and run update/upgrade commands without password prompts:

$ sudo apt update
$ sudo apt upgrade

Other commands will still require authentication or be denied based on configuration.

Add Sudo User Restrictions with the Sudoers File

To strengthen security, you can apply rules on how members of the sudo group interact with the sudo command. For example, you can control the number of failed password attempts and the duration that sudo remembers authentication. Use the passwd_tries and timestamp_timeout directives in the sudoers file to set these restrictions.

Create a Sudoers Configuration for the Group

$ sudo visudo -f /etc/sudoers.d/sudogroup

Limit Password Retry Attempts

Defaults:%sudo passwd_tries=1

This rule means:

Defaults:%sudo: Applies to all sudo group members.
passwd_tries=1: Only one failed password attempt is allowed.

To apply this to a single user instead of the group, use:

Defaults:john passwd_tries=1

Force Password Prompt Every Time

Defaults:%sudo timestamp_timeout=0

Explanation:

timestamp_timeout=0: No grace period. The user must re-enter the password for every sudo command.
Default value: 15, which means 15 minutes of reuse per terminal session.

Test the Restriction

Try installing a package with an incorrect password:

$ sudo apt install nginx

Output:

sudo: 1 incorrect password attempt

Retry with the correct password:

$ sudo apt install nginx

Since timestamp_timeout is set to 0, you will be asked for the password again. Once entered correctly, the package installs.

Note: By default, timestamp_timeout is set to 15 minutes, meaning sudo commands can be reused within that time window without re-entering the password.

Remove Users from the Sudo Group

If a user no longer requires administrative rights, you can revoke their sudo privileges by removing them from the group. The example below uses john.

Switch to Another Privileged User

$ sudo su - linuxuser

Remove Custom Sudoers Configuration

$ sudo rm /etc/sudoers.d/john

Warning: Ensure you still have access to another sudo-capable account before removing the only administrative user.

Remove the User from the Group

$ sudo deluser john sudo

Sample system output:

info: Removing user `john' from group `sudo' ...

Verify Removal

$ groups john

Example output:

john : john users

Switch to john and test sudo:

$ sudo apt update

Expected result:

Sorry, user john is not allowed to execute '/usr/bin/apt update' as root on LinuxWorkstation.

Note: Group membership updates take effect in new terminal sessions only.

Grant Users Sudo Access with the Sudoers File

You can also give sudo rights without adding the user to the sudo group. This is possible because sudo checks permissions defined in the sudoers file. Typically, group access is granted by this line in the main sudoers file:

%sudo   ALL=(ALL:ALL) ALL

This rule gives all members of the sudo group full access. You can still create custom rules for individual users.

Create a New User

$ sudo adduser joe

Create a Custom Sudoers File

$ sudo visudo -f /etc/sudoers.d/joe

Add this line for full sudo access:

joe ALL=(ALL) ALL

Verify Group Membership

$ groups joe

Output:

joe : joe users

Switch and Test

$ sudo su - joe

Now test:

$ sudo whoami

Expected output:

root

Conclusion

You have seen how to manage sudo privileges either by assigning users to the sudo group or by defining rules directly in the sudoers file. Using the sudo group is convenient, while custom sudoers configurations provide fine-grained control over which commands can be executed and under what conditions.

Jetzt 200 € Guthaben sichern

Testen Sie Ihr Setup auf ccloud³

Registrieren Sie sich in der ccloud³ und erhalten Sie 200 € Startguthaben für Ihr Projekt – z. B. für eine PostgreSQL-VM mit automatischen Backups.

Jetzt loslegen

Manage Sudo Users in Linux: Add, Restrict & Remove Access

Prerequisites

Adding Users to the Sudo Group

Verify Logged-in User

Check Current Sudo Privileges

Create a New User

Check if a User Has Sudo Rights

Grant Sudo Access

Switch to the User and Test

View Members of the Sudo Group

Using getent

Using groups

Restricting Access with the Sudoers File

Define Allowed Commands

Verify Custom Rules

Add Sudo User Restrictions with the Sudoers File

Create a Sudoers Configuration for the Group

Limit Password Retry Attempts

Force Password Prompt Every Time

Test the Restriction

Remove Users from the Sudo Group

Switch to Another Privileged User

Remove Custom Sudoers Configuration

Remove the User from the Group

Verify Removal

Grant Users Sudo Access with the Sudoers File

Create a New User

Create a Custom Sudoers File

Verify Group Membership

Switch and Test

Conclusion

Testen Sie Ihr Setup auf ccloud³

Kommentare

Frage oder Anmerkung hinterlassen

Das könnte Sie auch interessieren

Linux Export Command: Syntax, Examples and Usage

PostgreSQL-Datenbanken sichern und wiederherstellen mit pg_dump

Wie Sie Unit-Tests in Flask durchführen

Jetzt kostenlos anfangen