Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

So far I have found four different ways to add a user to the sudoers group and not all methods work in all systems. Why so many different implementations? What is the best? What is the standard (i.e. work in most systems)?

Different implementations:

  1. Adding the user to the 'wheel' group.
  2. Adding the user to the 'sudo' group.
  3. Editing the file /etc/sudoers
  4. Editing the file /etc/sudoers using visudo
share|improve this question
    
If you want to put somebody in a group you edit /etc/group. –  mikeserv Mar 29 at 23:46

3 Answers 3

up vote 3 down vote accepted

There are two (main) ways you can authorize a user to run commands as root via sudo:

  • declare that “Alice may run commands as root”;
  • declare that “Alice is a sysadmin” and that “sysadmins may run commands as root”.

The way to declare “Alice is a sysadmin” is to make her a member of the sysadmins group, but there is no standard name for the sysadmins group (nor any obligation that there is a sysadmins group). Some traditional Unix systems have a group called wheel, but often being in the wheel group is only a prerequisite for becoming root, and the user must also know the root password and run su (that's how BSD uses it, in particular). Some distributions, such as Ubuntu and Debian, include a group called sudo and a rule “members of the group sudo may run command as root” in their default configuration.

If /etc/sudoers (or a file in /etc/sudoers.d) contains a line like %sudo ALL=(ALL:ALL) ALL, then you can make a user a sudoer by adding them to the sudo group (adduser alice sudo). The name sudo isn't magical, you just have to match the entry in /etc/sudoers.

Never edit /etc/sudoers (or a file under /etc/sudoers.d) directly: if you make a syntax error, you would lock yourself out of root access. Always use visudo to edit that file. To choose the editor that visudo runs, set the VISUAL environment variable (or EDITOR, as long as VISUAL is unset). On a multiuser machine, using visudo has the additional advantage that it takes care of locking in case two administrators edit the file at the same time.

share|improve this answer

adduser username sudo works for me -- but then, I use Debian which has a sudoers file that defaults to giving everyone in the sudo group sudo access.

share|improve this answer

The method 2 and 4 will work on almost every Linux. Don't even try to use 3 on working system! It can damage the system. Method 1 can work, but don't have to.

Why you should use visudo instead of manually editing /etc/sudoers?

Once I had root access I used visudo to fix the sudoers file. Why visudo? Because that’s the program YOU ARE SUPPOSED TO USE. Yes I am a bit angry, because the person that broke this server should have known better. Visudo is a lovely little program that checks the syntax of the sudoers file before you save it so that if you do something monumentally stupid you’ll know about it before it becomes a problem and prevents you from getting back into the system as root.

http://lickthesalt.com/2009/07/06/fail-why-you-should-always-use-visudo/

share|improve this answer
2  
Exactly what is meant by damage the system? /etc/sudoers is a text file read by sudo to establish its permissions rules. sudo interprets certain syntax and formatting rules according to its api. visudo should reject any edits that don't conform to these standards, but editing the file otherwise is perfectly safe so long as the rules are obeyed. There is no mystery here. –  mikeserv Mar 29 at 10:49
    
@mikeserv see updated answer. –  enedil Mar 29 at 14:12
1  
I read that article before, and it was actually the one i was thinking of when i wrote the above comment. Your answer still obfuscates what actually happens should you 'damage your system,' and, and at least as i perceive it, contributes to FUD. Sorry. But thats my perception. –  mikeserv Mar 29 at 14:17
1  
And, visudo only protects you from syntactical errors - it's still possible to lock yourself out of the system with a bad sudoers configuration. So, you should still know how to get root without sudo. I usually edit /etc/sudoers with vi instead of visudo, write the file, and test my sudo access before exiting vi. That way I can revert my changes if it doesn't work. This doesn't work with visudo since it edits a temp file. Though these days it's not much of an issue since nearly all of my servers are managed by Puppet, including the sudoers file. –  Johnny Mar 29 at 14:47
1  
I'm not at all sure that the sudo group is more portable than wheel. Do you have a reference to support that claim? I'm pretty sure wheel is more common than sudo in the non-Debian world. –  terdon Mar 29 at 19:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.