The sudoers file has the following line:

root ALL=(ALL) ALL

I have read that the first field is the user. Then first ALL is all terminals, and (ALL) means as any user, and last ALL means any commands.

  1. What happens when we don't have this line in sudoers file? Then root couldn't do anything?

  2. username ALL= /bin/passwd like this, whether it could be interpreted as "username" can run passwd from ALL terminals

  3. What values can be given instead of first ALL?

2 Answers 2

  1. The sudoers file only controls what sudo invocations are possible. The line allowing root to do anything with sudo is not often useful, because root never needs sudo for anything. It's more of a convenience: that way you can write scripts that can be invoked indifferently by root or other sudoers and that call sudo to elevate privileges.

  2. username ALL = /bin/passwd allows the user to run the passwd command on any machine (and on any terminal — sudo doesn't care about that). Sudo allows the use of machine names in the sudoers file so that you can deploy a sudoers file without modification to all the machines in your network, and still have some rules that only apply to some of the machines.

  3. In the second position, you can have a host list (Host_List in the sudoers manual). This is a comma-separated list of host names. Instead of a host name, you can have an alias (see the manual for details), an IP address, or various ways of specifying a subnetwork (see the manual for details).

The sudoers manual is not an easy read, but it has a nice list of examples towards the end. I suggest you read that part first.


No sudo has really no power over the root user. This line is there on the off chance that root runs a command prefixed with sudo. This rule is allowing root to do this.

It's really more of a protection, so that root isn't blocked in cases where a script might have a command inside it that's prefixed with sudo.

Incidentally you read the rule as follows:

root ALL=(ALL) ALL

which means: let root run any command on any host as any user. So in a sense this rule is portable if you were to move it from one system to another, since it says nothing about limiting root to a particular host, or that root is limited in any kind of way via sudo.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .