I've been using Linux for a while now and whenever I typed sudo I thought I was switching over to the root user for a command.

Apparently this is not true because all I need is my user account's password. I'm guessing since I haven't worked with multiple users I haven't really noticed this in the real world.

I am unsure how Ubuntu sets up my first account. Is there a root user? Am I root? I'm guessing I just created a new user upon installation but it gave me root privileges? Just a little confused here...

So why am I allowed to run root commands with my user's password?

  • Using which user you need the password and in which you don't? What command you are running? Remember, that sudo stores your password for a time before you have to retype it.
    – Braiam
    Aug 18, 2014 at 1:58
  • 11
    sudo has the "setuid" bit set. So it runs as the user who owns it (which is root on all standard systems if I'm not mistaken), not the user who launches it. sudo then loads the /etc/sudoers file and checks what is allowed based upon who launched it.
    – LawrenceC
    Aug 18, 2014 at 14:38
  • 3
  • 1
    I’m sorry if I’m repeating something somebody else said, but I couldn’t find it. The answer is: It’s a policy decision. My best guess at the motivation is that, in a large installation where you have many people with sudo privilege, maybe working at geographically distributed locations and on 24×7 shifts, you want to be able to revoke one person’s privileged access immediately (e.g., if you suspect his integrity). If everybody is using the one-and-only root password, and you change that without prior coordination, chaos may result. … Aug 19, 2014 at 22:21
  • 1
    @HagenvonEitzen I know I'm a couple days late, but how is this not a dupe of our question?
    – strugee
    Aug 23, 2014 at 0:47

5 Answers 5


In details it works the following way:

  1. /usr/bin/sudo executable file has setuid bit set, so even when executed by another user, it runs with the file owner's user id (root in that case).

  2. sudo checks in /etc/sudoers file what privileges do you have and whether you are permitted to run the command you are invoking. Saying simply, /etc/sudoers is a file which defines which users can run which commands using sudo mechanism.

    That's how that file look on my Ubuntu:

    # User privilege specification
    root    ALL=(ALL:ALL) ALL
    # Members of the admin group may gain root privileges
    %admin ALL=(ALL) ALL
    # Allow members of group sudo to execute any command
    %sudo   ALL=(ALL:ALL) ALL

    The third line is what presumably interests you. It lets anybody in the "sudo" group to execute any command as any user.

    When Ubuntu sets up the first account during installation it add that account to the "sudo" group. You can check which groups which users belong to with group command.

  3. sudo asks you for a password. Regarding the fact that it needs user's password, not the root's one, that is an excerpt from sudoers manual:

    Authentication and logging

    The sudoers security policy requires that most users authenticate themselves before they can use sudo. A password is not required if the invoking user is root, if the target user is the same as the invoking user, or if the policy has disabled authentication for the user or command. Unlike su(1), when sudoers requires authentication, it validates the invoking user's credentials, not the target user's (or root's) credentials. This can be changed via the rootpw, targetpw and runaspw flags, described later.

    However, in fact, sudo does not need your user password for anything. It ask for it just to ensure that you are really you and to provide you some kind of warning (or chance to stop) before invoking some potentially dangerous command. If you want to turn off password asking, change the sudoers entry to:

  4. After authentication sudo spawns child process which run the invoked command. The child inherits the root user id from its parent -- the sudo process.

So, answering your questions precisely:

I thought I was switching over to the root user for a command.

You were right. Each command preceded with sudo runs with the root user id.

Is there a root user?

Yes, there is a root user account, separate from your user account created during system installation. However, by default in Ubuntu you are not allowed to login to interactive terminal as root user.

Am I root?

No, you are not a root. You only have privilege to run individual commands as a root, using the sudo mechanism described above.

So why am I allowed to run root commands with my user's password?

You have to enter user's password only due to sudo internal security mechanism. It can be easily turned off. You gain your root powers because of setuid bit of /usr/bin/sudo, not because of any passwords you enter.

  • 6
    The answer should really start with the setuid part, because that's the reason that it is actually possible. /etc/sudoers is just the reason for the flexibility of the sudo command. Aug 18, 2014 at 18:35
  • Interesting. I didn't know that you could specify that sudo could be run without inputting my password. Great answer!
    – jwir3
    Aug 18, 2014 at 19:37
  • 1
    Note that sudo can be configured to ask for the root password with the rootpw flag in sudoers. Aug 19, 2014 at 19:46
  • 2
    You can in fact login as the root user: sudo su - root will do just that and give you a root terminal. However you cannot easily login to a desktop session as root.
    – jmiserez
    Aug 19, 2014 at 20:59
  • 1
    Basically sudo has root privilege by itself, and it decides whether to impart that to you based on a configuration file.
    – Siyuan Ren
    Aug 20, 2014 at 9:38
  • The whole point of sudo is to grant you someone else's privileges (usually root) without asking for this other account's password (unlike su).

  • sudo is asking here for your password just to make sure a passer-by won't misuse your unlocked terminal.

  • Ubuntu and many other Linux and Unix OSes are granting an initial account created at installation time the right to run any commands as root.

  • While root is still an account under Linux, direct root logins are disabled by default for a better security and traceability.

  • 7
    Although direct root login is indeed disabled by default, there is still a root account with Ubuntu. It is no more an account on at least Solaris where it is by default a role.
    – jlliagre
    Aug 18, 2014 at 14:36
  • Thanks a lot - I always wondered how that worked anyway, and it now makes a lot more sense.
    – mikeserv
    Aug 18, 2014 at 18:56

Piotr gave a very good explanation of how sudo works. However, he didn't really motivate why it works this way, so I'll try to add that here.

Before the sudo command was created, we had the su command. This command allows one user to execute commands as another user, usually root (as with sudo, this is the default target user). It was totally undiscriminating, you can execute any command. Since it could be used by any user, was effectively equivalent to logging in as that user, it required you to know the target user's password.

At some point, a little more access control was added: to use su, you had to be a member of the wheel group. But since you still could execute any command, it still made sense to require you to know their password.

Requiring users to know each other's, or the superuser's, password was not very secure, though. Often you just want to give certain users limited access to some other account (this is part of a security concept called the principle of least privilege). It also makes accountability difficult: if multiple people know an account's password, and that account is involved in a mistake or abuse, you can't tell which of them actually did it.

So sudo was created. Rather than allowing users to execute any command, it has an elaborate configuration file, briefly touched on in Piotr's answer, that specifies precisely who may use it, what users they can switch to, and what commands they're allowed to run. With this fine-grained control over who can do what to whom, we no longer need to give users the target account's password; if we did, they could easily bypass all the controls in the configuration file by logging in as that user. Instead, we normally just require them to prove that they are who they logged in as, by entering their own password -- this is intended to prevent someone from taking advantage of an account if the terminal is left unattended.

This requirement is waived for the superuser -- this account can do almost anything to the system without using sudo, so it was deemed superfluous. It's also possible to specify in the configuration file that users don't have to enter a password at all -- some organizations use this when they believe the physical security of their workstation environment is sufficient to prevent abuse.

  • I haven't explored this, but I understand one of the features of sudo that su does not have is that it (is able to?) keep a log of what commands were run by which user to make it easier to trace problems back to their sources. I just looked on my kubuntu system and do not see such a log, so maybe this is not a default behavior.
    – Joe
    Aug 24, 2014 at 17:32
  • Just found sudo logging in /var/log/auth.log - along with a lot of other stuff including some IPs from China trying to get root ssh access to my system - so, if you just want to see sudo, you have to filter it through grep or similar.
    – Joe
    Aug 24, 2014 at 18:17
  • Correct. su also logs, but since it just starts a new shell, it just logs the fact that someone ran it.
    – Barmar
    Aug 25, 2014 at 15:52
  • You can not rely on the logs, anyone that can get root can change the logs (unless you log to another machine, and ensure that you do not give access until the logging transaction is complete). However sudo does allow privileges to be revoked, without having to re-issue the root password to everyone that needs it. Jun 14, 2015 at 22:20
  • 1
    @richard Since sudo allows you to restrict which commands a user can execute, you can try to make sure that you don't give them access to commands that would overwrite the log.
    – Barmar
    Jun 15, 2015 at 0:38

The answer to your question is:

When you run a command with sudo, you run the command with elevated priviliges, that is root priviliges. You only have to type your normal user password because you (the user) has been added to sudoers file which gives you root priviliges.

  • 2
    Except sudo doesn't imply elevated privileges, just different ones to the current user. E.g. you could run a program as a normal user who doesn't have a shell. Also, being in the sudoers file doesn't give root. Aug 19, 2014 at 1:10
  • 1
    @aragilar yes sudo does not always give elevated privileges, but it does run at elevated privileges, after doing its thing (checking authentication, it may drop privileges). It needs these elevated privileges to be able to change user. Jun 14, 2015 at 22:15
  • 1
    Sure, sudo does use elevated privileges (but that's not unique to sudo, e.g. mount does also), but the command that you call i.e. command in sudo command may not (depending on what is set in /etc/sudoers). Jun 16, 2015 at 1:01

First, disabling an account is usually done by setting the encrypted password to *, which is not the encrypted value of any string. I can't check right now, but I believe that's what Ubuntu does for root as well. So technically, there is no root password on Ubuntu.

But sudo precedes Ubuntu; it was designed for systems where there certainly were root passwords. So why doesn't it require the root password? Basically, sudo is designed to give permission to run specific commands to certain users --- e.g., allow a developer root access to re-start the web application, but not to start arbitrary servers. Knowing the root password, on the other hand, gives you unlimited access; you can use login or su to open a root shell and run arbitrary commands. Since sudo has to work for people without that level of access, it can't require the root password to run.

  • It also allows one to revoke a user's root privileges without having to change the root password. Aug 19, 2014 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.