How to Add a User to Sudoers in Ubuntu

A newly created Ubuntu account cannot run administrative commands. Every attempt ends with a message saying the user is not in the sudoers file, and the fix is to grant that account sudo privileges. On Ubuntu you can do this in two ways: add the user to the sudo group, which is the quickest route, or write a rule for the user in the sudoers configuration when you need finer control.

This guide explains both methods on Ubuntu 22.04, 24.04, and 26.04, and covers full sudo access, passwordless sudo , and access limited to specific commands.

Quick Reference #

For a printable quick reference, see the sudo cheatsheet .

Adding User to the sudo Group #

The easiest way to grant sudo privileges in Ubuntu is to add the user to the “sudo” group. Members of this group can execute any command as root and are prompted for their password when using sudo.

We are assuming the user already exists. If you still need to create the account, see our guide on creating a sudo user on Ubuntu , which walks through adduser and the home directory setup first.

To add the user to the sudo group , run the following command as root or another sudo user:

sudo usermod -aG sudo username

Replace username with the actual username you want to grant sudo access. The -a flag appends the user to the group, and -G names the supplementary group to add.

Ubuntu also ships adduser, which takes an existing user and a group directly:

sudo adduser username sudo

This has the same effect as usermod -aG sudo username and prints a short confirmation that the user was added to the group. Both commands are fine to use. usermod is available on most Linux distributions, while adduser is the more idiomatic choice on Ubuntu and Debian.

Verify Group Membership #

To confirm the user was added to the sudo group, use the groups command:

groups username

The output should include sudo in the list of groups:

username : username sudo

You can also use getent to inspect the sudo group’s member list, which is handy when auditing a server:

getent group sudo

Example output looks like this:

sudo:x:27:ubuntu,username

The fourth field holds the member list. The user you just added appears there next to any accounts that already had sudo access.

Test sudo Access #

After the user logs out and back in, have them run the whoami command with sudo from their own shell:

sudo whoami

If the user has sudo access, the command will prompt for a password and then print:

root

If you see an error saying “user is not in the sudoers file”, the user does not have sudo privileges.

Adding User to the sudoers File #

The /etc/sudoers file controls which users and groups have sudo privileges and what commands they can run. Editing this file directly allows you to grant customized access and configure specific security policies.

Using visudo #

Always use the visudo command to edit the sudoers file. This command validates the syntax before saving, preventing errors that could lock you out of sudo access entirely.

To open the sudoers file:

sudo visudo

On a default Ubuntu installation, visudo opens the file in nano . The sudo package is built to call /usr/bin/editor, and the alternatives system normally points that name at nano. To use nano for one edit, pass EDITOR on the sudo command line:

sudo EDITOR=nano visudo

Users with full sudo access can set EDITOR this way because an ALL command rule implies permission to set command-line environment variables. A restricted sudo rule may block the assignment. To change /usr/bin/editor for the whole system instead, run sudo update-alternatives --config editor. This also affects other programs that use the system editor alternative.

Grant Full sudo Access #

To grant a user full sudo privileges, add the following line at the end of the file:

username ALL=(ALL:ALL) ALL

This line means:

• username - The user this rule applies to.
• ALL (first) - The rule applies on all hosts.
• (ALL:ALL) - The user can run commands as any user and any group.
• ALL (last) - The user can run all commands.

Save the file and exit the editor .

Grant Passwordless sudo Access #

To allow a user to run sudo commands without entering a password, use the NOPASSWD directive:

username ALL=(ALL:ALL) NOPASSWD:ALL

Scoping NOPASSWD to the handful of commands a script really needs is safer than granting it for everything. Our guide on running sudo commands without a password covers that setup in more detail.

Grant Access to Specific Commands #

To limit sudo access to selected commands, list the full paths to those commands:

username ALL=(ALL:ALL) NOPASSWD: /usr/bin/mkdir, /usr/bin/rmdir

This allows the user to run mkdir and rmdir with sudo without entering a password. Because the rule does not include command arguments, the user can pass any arguments those programs accept.

Write the path that sudo actually resolves. Ubuntu searches secure_path, which lists /usr/bin ahead of /bin, so sudo mkdir runs /usr/bin/mkdir. A rule written as /bin/mkdir does not match that path on Ubuntu 22.04 and the command is refused, because sudo only began canonicalizing command paths in version 1.9.14 and 22.04 ships 1.9.9. Confirm the path the same way sudo will:

sudo which mkdir

To require a password and allow only one set of arguments, include the arguments in the rule and omit NOPASSWD:

username ALL=(ALL:ALL) /usr/bin/systemctl restart nginx

This rule matches systemctl restart nginx, but it does not allow the user to edit the service or restart a different unit.

Using the sudoers.d Directory #

Instead of editing the main sudoers file, you can create a separate configuration file in the /etc/sudoers.d directory. Ubuntu pulls that directory in from the last line of /etc/sudoers:

@includedir /etc/sudoers.d

On older systems the same directive is written #includedir /etc/sudoers.d. Despite the leading #, that line is not a comment. Sudo 1.9.1 introduced the @ spelling and still accepts the older one, so leave whichever line your system already has.

To create a drop-in file for a specific user:

sudo visudo -f /etc/sudoers.d/username

Add your rules to this file:

username ALL=(ALL:ALL) NOPASSWD:ALL

This approach makes managing sudo privileges more maintainable. It is common practice to name the file after the username it configures.

View User sudo Permissions #

To list what sudo commands a user can run, use the -l option:

sudo -l -U username

The output shows all allowed and denied commands for that user.

Troubleshooting #

“username is not in the sudoers file”
The user is not a member of the sudo group and has no entry in the sudoers file. Add them to the sudo group with usermod -aG sudo username or create a sudoers entry.

Group changes not taking effect
The user must log out and log back in for group membership changes to apply. Alternatively, start a new login shell with su - username.

“sudo: unable to resolve host”
The current hostname cannot be resolved locally. Check it with hostname, then make sure /etc/hosts contains the same name. On Ubuntu, the usual entry is 127.0.1.1 hostname; keep 127.0.0.1 assigned to localhost.

Syntax error in sudoers file
If you edited the sudoers file without visudo and introduced an error, you may lose sudo access. Boot into recovery mode or use pkexec visudo to fix the file.

“sudo: no tty present and no askpass program specified”
This occurs when running sudo in a non-interactive environment (like a script) without NOPASSWD configured. Add NOPASSWD for the specific commands the script needs.

Permission or ownership error for a sudoers.d file
Ubuntu normally expects files in /etc/sudoers.d to be owned by root and use mode 0440. Correct both values, then validate the complete sudoers configuration:

sudo chown root:root /etc/sudoers.d/username
sudo chmod 0440 /etc/sudoers.d/username
sudo visudo -c

FAQ #

What is the difference between the sudo group and the sudoers file?
The sudo group is a convenient way to grant full sudo access to multiple users. The sudoers file provides fine-grained control, allowing you to specify which commands a user can run, whether a password is required, and other security policies.

Do I need to restart after adding a user to the sudo group?
No system restart is required, but the user must log out and log back in for the group membership to take effect.

Is passwordless sudo safe?
Passwordless sudo reduces security because anyone with access to the user account can run commands as root without authentication. Use it only for service accounts or automated processes, and limit it to specific commands when possible.

Can I grant sudo access to a group instead of a user?
Yes. Use the % prefix to specify a group in the sudoers file. For example, %developers ALL=(ALL:ALL) ALL grants sudo access to all members of the developers group.

How do I remove sudo access from a user?
Remove the user from the sudo group with sudo deluser username sudo (or gpasswd -d username sudo). If they have a sudoers file entry, delete it with sudo rm /etc/sudoers.d/username or remove the line from /etc/sudoers using visudo.

What happens if I make a syntax error in the sudoers file?
If you use visudo, it will detect the error and refuse to save the file. If you edited the file directly and introduced an error, sudo may stop working entirely. Use recovery mode or pkexec to fix it.

Conclusion #

For day-to-day work, add the user to the sudo group with usermod -aG sudo username and have them log out and back in. Reach for visudo and /etc/sudoers.d only when you need to scope sudo to specific commands or set up passwordless access for a service account, and keep one drop-in file per user so the rules stay easy to audit.

If you also manage groups beyond sudo, see our guide on adding a user to a group in Linux .

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 1000+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page