Linux · Command Cheat Sheet · System Administration
Linux sudo Cheat Sheet: Commands, Options and sudoers
Use this practical sudo reference to run commands with elevated privileges, switch execution users, manage cached credentials, inspect permissions, handle redirection, and configure sudoers safely on Linux servers.
sudo command for one privileged task, sudo -l to inspect allowed commands, and sudo visudo to safely edit sudoers policy. Avoid granting unrestricted passwordless access unless it is explicitly justified.What is sudo?
sudo lets an authorized user execute a command as another user, usually root. The sudoers policy determines which commands are permitted and under what conditions. This makes it possible to delegate administrative tasks without sharing the root password.
Commands below are common OpenSSH/Linux administration patterns, but exact options, group names, defaults, and log locations can differ by distribution and sudo version. Check the local manual with man sudo and man sudoers before changing security policy.
1. Basic sudo commands
| Command | Purpose |
|---|---|
sudo command | Run one command as the default target user, usually root. |
sudo -u username command | Run a command as a specified user. |
sudo -g groupname command | Run with a specified primary group, if policy permits. |
sudo -i | Start a root login shell with the target user’s login environment. |
sudo -s | Start a shell as the target user without requesting a login shell. |
sudo -e /etc/hosts | Edit a protected file using sudo’s edit mode. |
sudo -b command | Start the command in the background. |
sudo -- command --help | Stop sudo option parsing so subsequent options are passed to the command. |
sudo !! | In Bash or Zsh, rerun the previous history command with sudo; shell history expansion must be enabled. |
sudo command when possible. An interactive root shell such as sudo -i is powerful and can make accidental system-wide changes easier.2. Password caching and prompts
| Command or setting | What it does |
|---|---|
sudo -v | Validate or refresh cached credentials without running another command. |
sudo -k | Invalidate the current terminal’s cached timestamp; the next privileged command may prompt again. |
sudo -K | Remove cached credentials for the invoking user. |
sudo -n command | Do not prompt; fail if authentication would require an interactive prompt. |
sudo -A command | Use the configured askpass helper to obtain a password when supported and configured. |
sudo -p "Password for %u: " command | Use a custom password prompt. |
Defaults timestamp_timeout=10 | Example sudoers setting: cache credentials for ten minutes. |
Defaults timestamp_timeout=0 | Require authentication for each command according to policy. |
Credential timeout defaults vary. Linuxize reports a 15-minute default for Debian/Ubuntu packages and a five-minute upstream default used by Fedora/RHEL. Verify the actual policy on your system rather than assuming one value applies everywhere.
Check whether cached credentials remain valid without prompting
sudo -n -vThis exits successfully if sudo can validate credentials without prompting; otherwise it returns a nonzero status. In scripts, check the exit code instead of assuming a password prompt will be available.
3. Check your sudo privileges
| Command | Purpose |
|---|---|
sudo -l | List commands the current user may run. |
sudo -ll | Display matching privileges in long form. |
sudo -l -U username | Inspect another user’s privileges when authorized. |
sudo -l /usr/bin/systemctl | Check whether a particular command is permitted; behavior depends on the installed sudo version and policy. |
sudo -V | Display sudo version and configuration information. |
id -nG | List the current user’s group names. |
getent group sudo | Show the sudo group entry on distributions that use this group. |
Group names differ: Debian and Ubuntu commonly use sudo, while Fedora and RHEL commonly use wheel. Membership is not the whole policy; sudoers rules and included configuration files determine the effective permission set.
4. Environment handling
| Command or setting | Purpose |
|---|---|
sudo -E command | Request preservation of the caller’s environment, subject to policy. |
sudo --preserve-env=http_proxy command | Request preservation of a named variable, subject to policy. |
sudo -H command | Request setting HOME to the target user’s home directory. |
sudo env | Inspect the environment passed to the command. |
Defaults env_reset | Use a restricted environment as the basis for privileged commands. |
Defaults secure_path="/usr/sbin:/usr/bin:/sbin:/bin" | Example PATH policy for privileged commands; use paths appropriate to the system. |
Environment preservation is not guaranteed: sudoers policy can reject or filter variables. Avoid preserving untrusted environment variables into privileged commands, particularly variables that influence executable lookup, library loading, or configuration.
5. Redirects, pipes, and multiple commands
The shell processes redirection before launching sudo. As a result, this common example usually fails when the current user cannot write to /root:
sudo echo "test" > /root/file.txtUse tee to write through a privileged process:
echo "test" | sudo tee /root/file.txt
echo "another line" | sudo tee -a /root/file.txtOr run a shell that performs the redirection as root:
sudo sh -c 'echo "test" > /root/file.txt'Only the command immediately launched by sudo runs with elevated privileges. In a pipeline such as sudo cat /etc/shadow | wc -l, cat runs as root while wc runs as the current user.
To run a sequence with shell operators under a privileged shell:
sudo sh -c 'cd /root && ls -l | wc -l'Quote the command string so the current shell does not process the operators before the privileged shell receives them. Use this pattern cautiously because every command inside the quoted string runs with the shell’s elevated privileges.
6. Edit sudoers safely
Use visudo rather than editing /etc/sudoers directly. It checks the policy syntax before saving, helping prevent a typo from breaking sudo access.
sudo visudoFor maintainability, many distributions support drop-in files under /etc/sudoers.d/. Create them with visudo -f so the file is checked:
sudo visudo -f /etc/sudoers.d/ops-teamExample rule granting a user permission to run one exact command:
opsuser ALL=(root) /usr/bin/mkdirThis is an illustrative policy rule. Verify the actual executable path with command -v mkdir and consider whether arguments must also be restricted. Do not assume that allowing an editor, interpreter, pager, or other powerful executable is a safe narrow permission: many programs can launch child commands or otherwise escape their apparent task.
7. sudoers rule syntax and examples
A common sudoers rule has the general form:
user host=(runas_user:runas_group) tags: commands| Example rule | Meaning / caution |
|---|---|
username ALL=(ALL:ALL) ALL | Broad administrative access for the named user. |
%sudo ALL=(ALL:ALL) ALL | Common Debian/Ubuntu group rule. |
%wheel ALL=(ALL) ALL | Common Fedora/RHEL group rule. |
username ALL=(ALL) NOPASSWD: ALL | Unrestricted commands without a password prompt; high risk and generally unsuitable as a default. |
username ALL=(root) /usr/bin/systemctl restart nginx | Example command-specific grant; confirm command path and argument matching behavior. |
username ALL=(www-data) /usr/bin/php | Allows running a command as a service account, subject to the policy’s command matching. |
Defaults timestamp_timeout=15 | Example timeout setting; check local distribution defaults and policy precedence. |
Defaults passwd_tries=3 | Example limit on password attempts. |
visudo and test it in a separate session before closing your administrative session.8. Logging and auditing
| Command or setting | Purpose |
|---|---|
sudo journalctl _COMM=sudo | Search systemd journal entries associated with sudo on systems that record them there. |
sudo journalctl -t sudo -S today | Search journal entries with the sudo syslog identifier from today. |
sudo grep sudo /var/log/auth.log | Check the common authentication log on Debian/Ubuntu systems that use this file. |
sudo grep sudo /var/log/secure | Check the common secure log on Fedora/RHEL systems that use this file. |
Defaults logfile="/var/log/sudo.log" | Example configuration for a dedicated sudo log file. |
Defaults log_input, log_output | Enable input/output logging where supported and configured; consider privacy and storage requirements. |
sudo sudoreplay -l | List recorded sessions when I/O logging is enabled. |
Logging behavior depends on the local sudoers policy and system logging configuration. A privileged interactive shell is especially important to account for: ordinary sudo logs may record the shell launch, but not necessarily every command typed inside that shell unless I/O logging or another auditing mechanism is configured.
9. Common sudo troubleshooting
“User is not in the sudoers file”
Check group membership and the configured policy:
id -nG
sudo -lIf you do not have administrative rights, ask an authorized administrator to grant the minimum required access. Adding a user to an administrative group requires an existing root or administrator session.
“Permission denied” when redirecting output
The current shell likely opened the destination before sudo ran. Use sudo tee or a carefully quoted privileged shell, as shown above.
“Command not found” after using sudo
Sudo may use a restricted PATH. Use the verified absolute path of the command and inspect the effective policy. Do not solve this by indiscriminately adding writable directories to the privileged PATH.
sudo asks for a password in a script
For non-interactive scripts, sudo -n command fails instead of waiting for input. Configure a narrowly scoped policy for the required operation rather than granting NOPASSWD: ALL.
Concerned that credentials remain cached
Use sudo -k to invalidate the current terminal’s timestamp, or sudo -K to remove cached credentials for the invoking user. Exact behavior may vary with the sudo version and timestamp configuration.
10. Quick reference: the commands to remember
| Task | Command |
|---|---|
| Run one command as root | sudo command |
| Run as another user | sudo -u username command |
| Open a root login shell | sudo -i |
| Inspect privileges | sudo -l |
| Refresh credentials | sudo -v |
| Invalidate current terminal’s cache | sudo -k |
| Run without prompting | sudo -n command |
| Safely edit sudoers | sudo visudo |
| Write a root-owned file | echo "text" | sudo tee /root/file |
| Check version | sudo --version |
Conclusion
sudo is a core Linux administration tool for delegating privileged operations while preserving individual user identities and policy controls. Learn the basic command patterns, understand password caching, inspect effective privileges, and use visudo to edit rules safely.
For production servers, grant only the access needed for each role, avoid unrestricted passwordless rules, protect environment and PATH handling, and confirm local defaults rather than copying policy assumptions between distributions.
Official references and further reading
- sudo(8) — Linux manual page — command options and behavior.
- sudoers(5) — Linux manual page — policy syntax, defaults, command matching, and logging.
- Sudo project documentation: sudoers — upstream policy reference.
- Linuxize sudo cheatsheet — source reference for this quick-reference topic.
