Ubuntu · Linux Administration · User Management

How to Add a User to Sudoers in Ubuntu

Grant administrative privileges to an Ubuntu user using the recommended sudo group method or a more specific sudoers rule. This guide covers verification, safe configuration, common errors, and least-privilege recommendations.

By Khurram Shahzad · October 19, 2026 · Linux Tutorial

What does it mean to add a user to sudoers?

On Ubuntu, an authorized sudo user can run administrative commands using their own password, rather than sharing the root account password. By default, Ubuntu grants broad sudo permissions to members of the sudo group. The sudoers policy can also define more limited permissions for individual users or groups.

Choose the method that matches the access you intend to grant. Adding a user to the sudo group usually grants broad root-level command access; it is not a way to allow just one maintenance task.

Before you begin

• You need an existing Ubuntu user account.
• You must have access to an account that already has administrative privileges, or an authorized root session.
• Keep your current administrator session open while changing access rules, so you can recover if a policy edit is incorrect.
• Use a trusted console or SSH connection and verify the target username before granting privileges.

Ubuntu Server documentation explains that the root account is disabled for direct password login by default on a standard installation, and that sudo is the normal way to perform administrative tasks.

Method 1: Add the user to the sudo group

This is the simplest method when the user genuinely needs full administrative privileges.

Step 1: Add the account to the group

Run the following command from an existing administrator account:

sudo usermod -aG sudo username

Replace username with the account you want to authorize. The -a option appends the supplementary group; -G sudo specifies the group to add.

Alternative: Use Ubuntu’s adduser command

Ubuntu also supports adding an existing user to a group with adduser:

sudo adduser username sudo

This has the same intended effect for this task and is idiomatic on Ubuntu and Debian systems.

Step 2: Refresh the user’s login session

New group membership normally takes effect when the user starts a new login session. Ask the user to log out and log back in, or start a fresh session. For an interactive shell, the following command can start a shell with the sudo group active:

newgrp sudo

Remember that newgrp changes the group context for the new shell; for a normal desktop or SSH login, logging out and back in is the clearest way to refresh all session processes.

Step 3: Verify group membership

Check the account’s groups:

groups username

The output should include sudo. You can also inspect the group entry:

getent group sudo

The output lists the group and its supplementary member list. A user may still have policy exceptions or directory-service-managed access, so group membership alone is not a complete audit of effective permissions.

Step 4: Test sudo access

Sign in as the user you just authorized, then run:

sudo whoami

After authentication, a typical successful result is:

root

You can also inspect the user’s allowed commands from an administrator session where policy permits:

sudo -l -U username

If you receive “user is not in the sudoers file,” confirm the account name, group membership, and whether the user has started a fresh session.

Method 2: Add a user with a specific sudoers rule

Use a dedicated sudoers rule when the user should run only a defined set of administrative commands. This is more precise than adding the account to the sudo group, but command restrictions require careful design.

Step 1: Create a drop-in file with visudo

Use visudo so the file is checked for syntax errors:

sudo visudo -f /etc/sudoers.d/username

Replace the filename with a suitable name for the rule. Avoid spaces in the filename and ensure it is readable by sudo’s policy parser under the expected ownership and permissions.

Step 2: Add a narrowly scoped rule

For example, a rule may allow a user to run a particular executable as root:

username ALL=(root) /usr/bin/systemctl status nginx

This is an illustrative rule; verify the command path and how your sudo version matches arguments before relying on it. Allowing an executable without adequate argument restrictions may grant more capability than intended. Some programs can start shells, load plugins, or invoke other commands.

If the user needs to manage multiple services or perform broader administration, evaluate whether a well-defined group or role is more appropriate than accumulating many ad hoc rules.

Step 3: Validate the policy

After saving the file, validate sudoers syntax:

sudo visudo -c

Then inspect the user’s effective permissions:

sudo -l -U username

Keep the current administrator session open until you have confirmed that the new rule behaves as intended. If syntax validation fails, correct the file before ending your working session.

Method 3: Grant passwordless sudo only when justified

Some automation tasks require commands to run without an interactive password prompt. Avoid granting NOPASSWD: ALL by default because it gives the account unrestricted administrative access without the normal authentication prompt.

If a service account genuinely needs passwordless access, restrict the rule to the exact executable and required arguments, and consider the risk of that command’s ability to run other programs. For example, a highly constrained rule might use this form:

username ALL=(root) NOPASSWD: /usr/bin/systemctl status nginx

This example is for illustration, not a universal production policy. Validate the exact path, command matching, and sudo implementation in your environment. If a command supports arbitrary arguments or shell escapes, a rule may not be as restrictive as it appears.

For automation, also consider whether a system service, configuration-management tool, or dedicated narrowly scoped helper is a safer design.

Common errors and troubleshooting

The user is still denied after adding the group

• Confirm the correct account was changed: groups username.
• Have the user log out and log back in to refresh group membership.
• Check the effective policy with sudo -l -U username.
• Verify that no later rule, host restriction, or external identity provider policy affects access.

Accidentally removed other group memberships

If usermod -G sudo username was run without -a, the supplementary group list may have been replaced. Inspect the account with id username and restore the intended groups carefully with an administrator. Do not guess which groups the user needs; check the system’s prior configuration or service requirements.

visudo reports a syntax error

Use the line number and diagnostic from visudo to correct the rule. Do not force-save a malformed policy. A syntax error can prevent sudo from working as expected and may lock out routine administrative access.

The user is managed by LDAP or Active Directory

Local group files may not be the complete source of identity or membership. Ubuntu uses the Name Service Switch to resolve users and groups from configured sources. Follow the organization’s central identity and privilege-management process rather than making an untracked local change.

Security best practices

Quick reference

Conclusion

For full administrative access on Ubuntu, adding an existing user to the sudo group is the straightforward method. When a user needs only a specific administrative operation, use a carefully scoped sudoers rule and validate it with visudo.

Always confirm the target account, preserve existing group memberships, refresh the user’s session, and verify the effective permissions before considering the change complete.

Official references and further reading

• Ubuntu Server documentation: User management — user and group administration.
• Ubuntu Server documentation: User security — sudo and administrative access on Ubuntu.
• Ubuntu manpage: visudo — safe sudoers editing and syntax validation.
• Ubuntu manpage: sudoers — policy syntax and privilege rules.
• Linuxize: How to Add a User to Sudoers in Ubuntu — source article for this tutorial topic.