sudo
Overview
sudo runs a command as another user (default: root) according to policy in /etc/sudoers and /etc/sudoers.d/*. Prefer one-shot elevation over lingering in a root shell. On Ubuntu, members of the sudo group typically get full rights via the distro sudoers snippet.
Syntax
sudo [options] [command]
sudo -i
sudo -u user command
sudoedit file # same as sudo -eCommon Options
| Option | Description |
|---|---|
-u user |
Run as user (not root) |
-g group |
Set primary group for the command |
-i |
Login shell as target user (loads target profile) |
-s |
Shell as target user (minimal env change) |
-E |
Preserve environment (policy permitting — often restricted) |
-k |
Invalidate cached credentials |
-K |
Remove timestamp entirely |
-l / -l -U user |
List allowed commands |
-n |
Non-interactive (fail if a password would be needed) |
-v |
Validate / extend timestamp without running a command |
-e / sudoedit |
Edit file safely as root |
-b |
Run command in background |
-g group |
Primary group for the command |
Key Use Cases
- Administrative package and service changes
- Least-privilege elevation per command
- Audited privileged actions (auth log / journal)
- Safe file edits as root (
sudoedit)
- Run maintenance as a service account (
-u)
Safety
- Never
chmodsudoers to world-writable. Always edit withvisudo.
- Pipelines:
sudo cat file | grep xonly elevatescat. Usesudo sh -c '…'orsudo grep x filewhen the whole pipeline needs root.
- Avoid
sudo su/sudo -ias a daily habit — harder to audit, easy to leave open.
- Be careful with
sudo -Eandenv_keep— leakingLD_PRELOAD/PATHinto root is a classic privilege path.
sudoedituses your editor on a temp copy; do not point$EDITORat untrusted wrappers.
Examples with Explanations
Run one admin command
sudo apt update
sudo systemctl restart nginxElevates only those processes; your shell remains an unprivileged user.
Edit a system file safely
sudoedit /etc/hosts
sudo -e /etc/ssh/sshd_configWrites to a temporary file and installs only if the editor exits successfully — safer than some sudo vim permission edge cases.
Root login shell when you need many steps
sudo -i
# … work …
exitLoads root’s login environment (HOME=/root, profile scripts). Exit promptly when finished.
Run as another service user
sudo -u www-data ls -la /var/www
sudo -u postgres psql -c '\conninfo'Debug permissions and DB access as the account that actually runs the service.
See your privileges
sudo -lShows what policy allows for your account (and matching host/command rules).
Pass env vars explicitly (preferred over -E)
sudo ENV=prod /usr/local/bin/deploy
sudo --preserve-env=http_proxy,https_proxy apt update # when policy allowsPrefer naming variables over blanket environment preservation.
Credential cache control
sudo -v # refresh timestamp
sudo -k # drop cache for this tty (next sudo asks again)Default timeout is often ~15 minutes per tty — do not assume it on shared jump hosts.
Non-interactive / scripts
sudo -n true || { echo "sudo needs a password; cannot continue" >&2; exit 1; }
sudo -n systemctl is-active nginx-n fails instead of prompting — essential for unattended scripts.
Dangerous patterns to avoid
# BAD: elevates only the left side
sudo cat /etc/shadow | grep root
# GOOD:
sudo grep root /etc/shadow
sudo sh -c 'cat /etc/shadow | grep root'Read logs of sudo use
journalctl -u sudo -n 50 --no-pager # when unit exists
grep -i sudo /var/log/auth.log | tail # Debian/Ubuntu rsyslog path
journalctl _COMM=sudo -n 50 --no-pagerUnderstanding Output
Successful commands look like the underlying tool’s output. Failures include password rejects, policy denials (Sorry, user … is not allowed…), and missing tty for password prompts. Exit status is usually that of the invoked command; policy denials return non-zero without running it.
Notes & Pitfalls
- Ubuntu’s default is group-based admin (
%sudo ALL=(ALL:ALL) ALL) — still prefer explicit command lists on hardened hosts.
- Lecture/insults and password prompts are configured in sudoers (
Defaults).
sudo !!re-runs the previous shell command with sudo — review!!expansion before Enter.
- Root-equivalent via misconfigured
NOPASSWD: ALLis convenient and dangerous; scope it tightly.
- Containers: passwordless sudo inside images is common for convenience — treat those images as root-equivalent.
Additional Resources
man sudo/man sudoers
visudo(8)