If a user with administrative privilege can have all the powers of root using sudo , then what is the advantage of having root account?

  • 1
    A typical usage is system maintenance possibly when you need a system recovery. For instance, when you select the "recovery mode" to boot from the Grub menu.
    – Barun
    Aug 27, 2013 at 7:04
  • 3
    Isn't not having to use sudo an advantage? Note that having "all the powers of root" is not quite the same as being root, since the root user can take those powers away, but no one can take them from root.
    – goldilocks
    Aug 27, 2013 at 8:26
  • Thank you everybody for help! Barun, goldlocks, slm, and Joseph R. Marking it as solved.
    – abchk1234
    Aug 27, 2013 at 17:27

2 Answers 2


Disabling root

You have to have a root account. The only things you can do with it, in terms of "disabling" it, are:

  1. Lock the account

    $ sudo passwd -l root
  2. Give root an unusable password

    $ sudo usermod -p '!' root

sudo - as user root

Remember that when a user with "administrative privileges" is making use of sudo they're running commands with elevated privileges as the user root!

You can see that this is true with a simple ps command:

$ sudo sh -c "ps -eaf | grep [s]udo"
root      2625 26757  0 04:19 pts/10   00:00:00 sudo sh -c ps -eaf | grep [s]udo

The above shows that when the ps command is executed, you're effectively the user root.


Also when booting into a system in single user mode (from GRUB), you'll need to login using the root account. Typically you're passing either the word single to GRUB or the number 1.

What sudo permissions do I have?

On a system where one has been given sudo permissions you can use the command sudo -l to see what rights you do have. These are not a complete set of everyone's rights, just the user that's running the command.

For example:

$ sudo -l
Matching Defaults entries for saml on this host:

User saml may run the following commands on this host:
    (ALL) ALL
    (root) NOPASSWD: /usr/lib/jupiter/scripts/bluetooth, (root) /usr/lib/jupiter/scripts/cpu-control, (root)
    /usr/lib/jupiter/scripts/resolutions, (root) /usr/lib/jupiter/scripts/rotate, (root) /usr/lib/jupiter/scripts/touchpad, (root)
    /usr/lib/jupiter/scripts/vga-out, (root) /usr/lib/jupiter/scripts/wifi

NOTE: The commands one's been granted access to are everything after the line, "User saml may run the following ....".

Limiting access via sudo

Sudo has a fairly rich facility for limiting access to specific commands, groups of commands, specific users, and/or specific groups of users. There are some caveats however with sudo.

You can grant full access to everything with this line in /etc/sudoers:

aaditya      ALL=(ALL)    ALL

You could also give a user what appears to be simple access to vim certain files:

aaditya      ALL=/usr/bin/vim

This would be a huge mistake however, since many editors such as vim allow you to invoke a subshell from within them. So the user aaditya would be able to gain access to a shell with root permissions, even if the sudo permissions didn't intend for that to happen.

  • At college I am using RHEL v5, and I have a sudo account (added myself to /etc/sudoers), but I cant run administrative commands like adduser( sudo adduser - gives output adduser: command not found). But when the system admin logins as root , he can perform the adduser command. So if using sudo gives me same privileges as root, why cant I perform the adduser command?
    – abchk1234
    Aug 27, 2013 at 14:43
  • 1
    @AadityaBagga - it's not giving you the same permissions as root, it's giving access to run certain commands AS root! If you're able to add yourself to /etc/sudoers, then you're likely able to do whatever you want. Adding a line such as this to /etc/sudoers: aaditya ALL=(ALL) ALL will grant you carte blanche access to do anything AS root.
    – slm
    Aug 27, 2013 at 14:59
  • I added myself to /etc/sudoers by requesting the sysadmin to let me access the root account using su. I thought that if I added myself to sudoers I could perform administrative commands but I cant!
    – abchk1234
    Aug 27, 2013 at 15:16
  • @AadityaBagga - if you have su access to root then you can do anything you want through that as well. A sudo -l is still the best way to see what your account has been granted, officially. There are always cracks 8-).
    – slm
    Aug 27, 2013 at 15:25
  • @slm..I dont have access to su! I requested the sysadmin to open a terminal with su so that I could add myself to the sudoers list in order to perform administrative commands, but I am not able to, as I have mentioned earlier. So perhaps there is a difference between the root account and an administrator added to /etc/sudoers.
    – abchk1234
    Aug 27, 2013 at 15:34

An administrative account and root are by no means the same. Other than what goldilocks and slm mentioned you should also know that root can significantly limit what the sudo user is allowed to do on root's behalf (see man sudoers for examples). This is especially useful when a senior sysadmin wants to delegate some administration tasks to a junior admin without granting them full access. After all, a user with full sudo access can hijack the root account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .