Cobra Softwares Blog

How to Create a Sudo User in Linux

Learn how to create a sudo user on Linux, manage permissions, and customize sudo behavior securely.

Creating a sudo user allows a non-root user to perform administrative tasks with elevated privileges. Instead of logging in as root, the user authenticates with their password, and the system securely logs each command they run. This approach improves system security by limiting root access and providing better accountability. Most Linux distributions follow a similar process for adding sudo users, with slight group names or package requirements variations.

This article explains how to create a sudo user on major Linux distributions, verify their privileges, and apply optional security settings to control sudo behavior.

Prerequisites

Before you begin, you need to:

• Have access to a Linux instance as a non-root sudo user.

Create a Sudo User

In this section, you will create a new user and grant them sudo privileges. While the exact steps may vary slightly between distributions, most follow a similar process. Start by choosing the section that matches your Linux distribution.

Test Sudo User Privileges in Linux

After setting up a sudo user, verify that the account has administrative privileges. This section walks you through several tests to confirm proper sudo functionality.

Run Basic Commands with Sudo

Run these commands to ensure the user can perform administrative tasks.

1. View the root user’s home directory.
   console

   $ sudo ls -la /root
   

   This command displays hidden and regular files in /root, which only root or users with sudo privileges can access.

2. Update the server package lists.
   • On Debian-based systems (Ubuntu, Debian):
     console

     $ sudo apt update
     

   • On Red Hat-based systems (RHEL, CentOS, Fedora):
     console

     $ sudo dnf makecache
     

   • On Arch Linux:
     console

     $ sudo pacman -Sy
     

   Package management commands require root privileges because they modify system files and packages. If these commands work without errors, your sudo setup is functioning.

Verify Access to Protected Files

Confirm that your sudo user can access sensitive files restricted to root.

$ sudo cat /etc/shadow

The /etc/shadow file contains encrypted user passwords and is critical for system security. It’s only readable by root or users with sudo privileges, so viewing it confirms your sudo privileges are working.

Check Sudo Logs

sudo maintains detailed logs of all activity, which is crucial for security auditing and accountability.

• On Debian-based systems, run:
  console

  $ sudo grep sudo /var/log/auth.log
  

• On Red Hat systems, run:
  console

  $ sudo grep sudo /var/log/secure
  

These logs record when users run sudo, who ran it, and which commands they executed. This audit trail is a key security advantage of using sudo instead of directly operating as the root user.

Manage Password Prompts for a Sudo User

In this section, you will configure how and when sudo prompts for a password, allowing you to fine-tune the balance between security and convenience.

Configure Password Timeout

By default, sudo caches your credentials for 15 minutes. Follow the steps below to customize this timeout to suit your workflow.

1. Open the sudoers file using the visudo utility.
   console

   $ sudo visudo
   

2. Add or modify the following line.
   ini

   Defaults        timestamp_timeout=30
   

   This example sets the timeout to 30 minutes. This value determines how long sudo remembers your authentication after a successful password entry.

   Special values for timestamp_timeout:

   • 0: Require the password for every sudo command.
   • -1: Never prompt again during the session.
   • Positive integers (for example, 5, 15, 30): Define the authentication timeout in minutes.

   Behind the scenes, sudo creates timestamp files in /var/run/sudo/ or /var/lib/sudo/ to track when users last authenticated.

Set Up Passwordless Sudo

For automation tasks or controlled environments, you can allow specific users or groups to execute sudo commands without being prompted for a password.

1. Open the sudoers file.
   console

   $ sudo visudo
   

2. Add a rule for the user.
   ini

   example_user ALL=(ALL) NOPASSWD: ALL
   

   Or configure it for an entire group:

   ini

   %wheel  ALL=(ALL) NOPASSWD: ALL
   

   Warning

   Enabling password-less sudo reduces security by eliminating authentication prompts. Use it only in secure environments with fully trusted users.

Limit Command Execution

Following the principle of least privilege, restrict which commands users can execute with sudo.

1. Edit the sudoers file.
   console

   $ sudo visudo
   

2. Define explicit command permissions.
   ini

   example_user ALL=(ALL) /usr/bin/apt update, /usr/bin/apt upgrade
   

   This configuration allows the user to run only the specified commands with sudo. Use absolute paths, as sudo does not resolve commands through $PATH.

   To locate a command’s full path, run:

   console

   $ which <command>
   

   For example:

   console

   $ which mkdir
   

   Output:

   /usr/bin/mkdir

Create Command Aliases

In multi-user environments, command aliases can simplify the privilege definitions.

1. Open the sudoers file.
   console

   $ sudo visudo
   

2. Define command groups and assign them.
   ini

   # Command Aliases
   Cmnd_Alias UPDATES = /usr/bin/apt update, /usr/bin/apt upgrade
   Cmnd_Alias SERVICES = /usr/bin/systemctl restart apache2
   
   # User Privileges
   example_user ALL=(ALL) UPDATES, SERVICES
   

Command aliases let you group related commands under a single name, making the sudoers file more organized and maintainable as it grows.

Conclusion

You have successfully created and configured a sudo user across major Linux distributions. You granted administrative privileges by assigning the user to the appropriate group (wheel or sudo) and verified access through protected commands. You also reviewed ways to enforce secure privilege escalation by customizing the sudoers file, such as restricting commands, enabling password-less access, and setting timeout and retry limits. With these configurations, your system now has properly managed sudo access, enhancing usability and security.

Learn how to create a sudo user on Linux, manage permissions, and customize sudo behavior securely. Creating a sudo user allows a non-root user to perform administrative tasks with elevated privileges. Instead of logging in as root, the user authenticates with their password, and the system securely logs each command they run.…

Learn how to create a sudo user on Linux, manage permissions, and customize sudo behavior securely. Creating a sudo user allows a non-root user to perform administrative tasks with elevated privileges. Instead of logging in as root, the user authenticates with their password, and the system securely logs each command they run.…