User does not have access to sudo on Debian 12 unless the system is rebooted

Question

I use Debian 12 and want to add a user bob to sudoers. While logged in as bob, I ran su root command to become root. As a root, I added bob to the sudo group using the following command:

sudo usermod -aG sudo bob

Right after that I inspected /etc/sudoers file, which had the following line: %sudo ALL=(ALL:ALL) ALL, which signifies that everybody who has sudo group has access to sudo.

However, when I exited the root shell issuing exit command and, therefore, returned to bob's shell, I was not able to use sudo as if bob still was not in the sudoers file: user not in sudoers.. Moreover, when I ran id command, bob did not have the sudo group. I tried to close the terminal and to log in / log out, but it did not work. It was required to reboot the machine so that bob had access to sudo.

Was there a way to not reboot the machine?

Answer 1

You didn't log in as bob, you opened a new terminal while already logged in. If you had opened a new login shell, for example with

sudo -iu bob

Then you would have seen the new group. Alternatively, if you had closed bob's open session (log out from the GUI) and then logged in again as bob, then too you would have seen the new group.

So no, rebooting isn't necessary to pick up new group changes, but logging in again is.

To illustrate:

$ whoami 
bob
$ groups
bob

$ su -
# whoami
root
# usermod -aG sudo bob
# groups bob
sudo bob
# exit

$ whoami 
bob
$ groups
bob

So it looks like it hasn't worked, but that's because you're back in the shell you started from. Try opening a new login shell (not just a new terminal, a new login shell) instead:

$ su -          ## become root
# sudo -iu bob  ## open a new shell as bob
$ whoami
bob
$ groups
sudo bob

---

PS. If you are logged in as root, for example with su or sudo -i, there is no reason to use sudo, just run the commands directly, you're already root.