What is the practical difference between:

  • adding a user to sudo (Debian) or wheel (RHEL) group

    sudo usermod -aG sudo/wheel <username>


  • creating a file named username with the following contents in /etc/sudoers.d/

    username ALL=(ALL:ALL) ALL

Effective difference? Not much. Biggest I can think of is that by adding the user to the sudoers group (or whatever group is needed) the user needs to log out/in or use newgrp to really become a member of that group and be able to sudo, whereas a file under /etc/sudoers.d/ wouldn't require that extra step.

Long term maintenance, etc. with more than just one user involved... the group membership may be "better" - it really comes down to work flow, etc. at that point and it rapidly moves this question even further into that grey murky area known as "opinion based answers". Obviously there may be some technical reasons behind choosing one over the other (ie, for the www-user to sudo and you don't want to or can't start/stop the webserver) but "which is better" is almost always opinion and situation based.


The only practical difference that I can see is in the situation where the sudoers file is a standard that is shared (deployed) amongst different machines. (And the user/group database is for some reason not shared. An unlikely situation, IMO.)

In this instance the user added to the sudo/wheel group will be able to execute any command as any user only on that machine, whereas the the user with an explicit entry in the sudoers file will be able to execute any command as any user on every machine.

  • we could combine our answers into a SuperAnswer! if you want ot copy/paste mine into yours as an edit, i'll cheerfully delete mine. – ivanivan Oct 18 '18 at 20:27
  • @ivanivan thank you. I think it's useful to keep both answers, if only to shows that there is not really much difference but that we've addressed the issue from different directions. – roaima Oct 18 '18 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.