# Users & permissions

Sudo and root access

The difference between su and sudo, and how to grant a user admin rights without sharing the root password.

su vs sudo

su switches to another user's full session (typically root) and keeps you there until you exit. sudo runs one command as root (or another user) and returns you to your own shell immediately afterward — it's the safer default because you're root for a single command, not an open-ended session.

bash

su -            # opens a root shell, asks for root's password
sudo apt update # runs one command as root, asks for YOUR password

Granting sudo access

Add the user to the distro's admin group — sudo on Debian/Ubuntu, wheel on RHEL/Fedora/Arch — rather than editing /etc/sudoers by hand for a routine case.

bash

usermod -aG sudo alice    # Debian/Ubuntu
usermod -aG wheel alice   # RHEL/Fedora/Arch — also uncomment
                          # '%wheel ALL=(ALL) ALL' in /etc/sudoers if not already active

Editing sudoers safely

Never edit /etc/sudoers directly with a normal editor — a syntax error can lock everyone out of sudo. visudo edits a temporary copy and validates the syntax before saving.

bash

visudo

Passwordless sudo for one command

For scripted/unattended tasks, a sudoers line can allow one specific command without a password prompt — narrower and safer than disabling the password check entirely.

text

deploy ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart myapp