I wanted to allow specific non root users to start/stop certain systemd services in CentOS7. But there has been no luck on the steps that I have tried so far. Here is what I have tried.

I have added the below details in sudoers file where testsudo is a user group and couple of users have been added to that group.

## Manage specific systemd services
Cmnd_Alias SYSTEMD = /bin/systemctl start httpd, /bin/systemctl stop httpd, /bin/systemctl restart httpd

## Allows nfam group to run init-system commands using the SYSTEMD command alias

Details of the group and added users:

# cat /etc/group | grep testsudo

Now if I try to start the service using any one of the user (who is a part of testsudo group), I get an authentication required message.

[userone@msgdroid ~]$ systemctl start httpd
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===
Authentication is required to manage system services or units.
Multiple identities can be used for authentication:
 1.  admin
 2.  priya
 3.  sekar
 4.  gokul
 5.  ravi
 6.  murali
Choose identity to authenticate as (1-6):


I have also used sudo infront of the command, but it doesn't work even.

$ sudo systemctl start httpd
[sudo] password for userone:
Sorry, user userone is not allowed to execute '/bin/systemctl start httpd' as root on webapp.


  • Just a correction, the server can only be accessed via SSH Keys and not via password. Will that be an issue?
  • 1
    You edited sudoers but didn't invoke sudo; do you want to use sudoers?
    – Jeff Schaller
    Nov 27, 2018 at 11:56
  • @JeffSchaller, is there any other alternate approach without using sudoers? Nov 27, 2018 at 12:03
  • Is testsudo a member of the sudo group? If not then that won't work as printed. Because userone may be in testsudo but if testsudo is not in sudo the resultis the same. Nov 27, 2018 at 13:29
  • I tested your configuration on a Debian server and it works. I suggest you to double check the syntax of the commands you entered in sudoers file (did you use visudo to do this ?). Check the spaces are spaces (and not alt-space e.g.), eventually rewrite it from zero.
    – lauhub
    Nov 27, 2018 at 14:06
  • 2
    It'd be interesting to see the output from sudo -l as userone on that system. Access via keys is no problem, as it appears that you know the password for the userone user.
    – Jeff Schaller
    Nov 27, 2018 at 14:12

2 Answers 2


I suggest you to try this:

sudo systemctl start httpd

You have to log out then log in again after you modified you sudoers file (you may not be able to use sudo until you do this).

You can also edit and replace the following:



%testsudo ALL=(root) NOPASSWD: SYSTEMD
  • Tried adding sudo but it doesn't help. Updated the question. Nov 27, 2018 at 12:02
  • Did you log out from userone then log in again ?
    – lauhub
    Nov 27, 2018 at 12:04
  • Yes I have logged out and logged in back. Nov 27, 2018 at 12:05
  • 2
    %testsudo ALL=(root) NOPASSWD: SYSTEMD translated to English: members of group "testsudo" on ALL hosts using this sudoers file are allowed to execute as root, without being asked for a password, any commands defined earlier on a CmndAlias SYSTEMD line.
    – telcoM
    Nov 27, 2018 at 14:48
  • 2
    The percent sign before the word testsudo means it is a group not an user. And the original poster says that the users that need to run the commands have already been added to the testsudo group.
    – telcoM
    Nov 27, 2018 at 14:52

If using sudoers, then you need to use sudo but you can hide its use in a script or alias.

I am wondering if the problem is that your users are not yet in the group. Adding a user to a new group, only writes to a file (/etc/groups). To activate it you need to start a new process, with the new group. There are two easy ways to do this: 1 logout and back in again; run newgrp groupname. This will start a new shell over the current one. It will be added to the new group, if and only if you are a member of the group (according to the file /etc/groups).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .