What Does Sudo Mean in Linux? Usage Guide

The sudo command is a standard Linux utility that lets a permitted user run a command as another user, usually root (the superuser). You type sudo before a command, enter your own password, and the command executes with elevated privileges. This article explains what sudo actually does, how to use it safely, and how to troubleshoot common issues.

What Is sudo?

sudo stands for “superuser do.” It is a standard program on virtually every Linux distribution and is also available on macOS and BSD systems. The name is a contraction of “superuser do,” and it is pronounced “sue-doo” or “soo-doo.” The word is standard technical terminology—not slang—and it has been part of Unix-like systems since the late 1980s. It was originally written by Bob Coggeshall and Cliff Spencer at the State University of New York at Buffalo, and later rewritten by Todd C. Miller, who still maintains it.

The core idea is simple: instead of logging in as root (the all-powerful administrator account), you stay logged in as a normal user and use sudo to execute specific commands with root privileges. This reduces the risk of accidental system damage and keeps a log of who ran what.

How sudo Works

When you run sudo command, the system checks a configuration file called /etc/sudoers to see if your username (or your group) is allowed to run that command. If allowed, sudo prompts for your password—not the root password—and then runs the command with root’s user ID (UID 0).

The password is cached for a short time (default 15 minutes), so you don’t have to type it again for every command. You can see the cached timestamp with sudo -v and clear it with sudo -k.

Here is a typical example:

$ sudo apt update
[sudo] password for alice:
Hit:1 http://archive.ubuntu.com/ubuntu jammy InRelease
...

In this case, alice is allowed to run apt as root. She enters her own password, and the command runs with full system access.

How to Use sudo

The basic syntax is:

sudo [options] command [arguments]

Common uses include:

sudo apt install package – install software on Debian/Ubuntu
sudo dnf install package – install software on Fedora
sudo systemctl restart service – restart a system service
sudo nano /etc/hosts – edit a system file
sudo -i – start a root shell (login shell)
sudo -s – start a root shell (non-login)
sudo -u www-data command – run as a specific user other than root

To see what commands you are allowed to run, use sudo -l. This lists the rules that apply to your user.

Configuring sudo: The sudoers File

The /etc/sudoers file controls who can use sudo and what they can run. You should never edit it directly with a regular text editor, because a syntax error can lock everyone out of sudo. Instead, use the visudo command, which opens the file in a safe editor and checks the syntax before saving.

A typical line in sudoers looks like:

alice ALL=(ALL:ALL) ALL

This means: user alice can run any command on any host as any user and any group. The fields are:

User – who the rule applies to (or a group with %group)
Hosts – which machines the rule applies to (usually ALL)
(Run-as) – which user and group the command can be run as
Commands – which commands are allowed (or ALL)

You can restrict a user to specific commands, for example:

bob ALL=(ALL) /usr/bin/systemctl restart nginx

This allows bob to restart nginx but nothing else as root.

sudo vs su: What’s the Difference?

su (substitute user) is the older way to switch to another user. When you run su, it asks for the target user’s password—if you want to become root, you need the root password. With sudo, you use your own password, and the system decides if you are allowed to act as root.

Another difference: su starts a new shell as the target user, whereas sudo runs a single command. You can get a root shell with sudo -i or sudo -s, but the default behavior is to run one command.

On modern desktop Linux distributions, the root account is often disabled by default, so su is not usable without first setting a root password. sudo is the preferred method because it provides fine-grained control and auditing.

Common sudo Errors and Fixes

Here are the most frequent issues users encounter:

“user is not in the sudoers file” – Your account is not permitted to use sudo. On Ubuntu, you can add yourself to the sudo group by booting into recovery mode or logging in as root. On other systems, the group may be called wheel.
“sudo: command not found” – The command you tried to run is not installed or not in the PATH. Check the full path, e.g., sudo /usr/sbin/command.
“sorry, you must have a tty to run sudo” – This happens when sudo is used in a script or over SSH without a pseudo-terminal. You can add the !requiretty option in sudoers, but it’s safer to use ssh -t to allocate a terminal.
“sudo: unable to resolve host” – The system’s hostname is not in /etc/hosts. Add a line like 127.0.1.1 myhostname to fix it.
Password not accepted – Make sure you are typing your own password, not the root password. Also check that Caps Lock is off.

Security Best Practices

Using sudo is safer than always working as root, but it still carries risk. Follow these guidelines:

Use the least privilege – Only give users the specific commands they need, not ALL.
Keep sudoers simple – Complex rules are hard to audit and easy to break.
Always use visudo – Never edit /etc/sudoers with a regular editor.
Check command paths – In sudoers, use absolute paths like /usr/bin/systemctl to avoid a user creating a fake command in their PATH.
Log everything – sudo logs each command to /var/log/auth.log (or journalctl). Review these logs periodically.
Use sudo -k when done – If you are on a shared machine, clear the cached credentials to prevent others from using your sudo access.

Frequently Asked Questions

Is sudo the same as root?

No. sudo lets you run a command with root privileges, but you are still logged in as your normal user. Root is the actual superuser account. With sudo, you don’t need the root password, and you can be granted limited access (e.g., only certain commands).

Why do I have to type my password every time?

By default, sudo caches your password for 15 minutes. If you are prompted every time, either the timeout has expired, or the system administrator has set timestamp_timeout to 0 in sudoers.

Can I run sudo without a password?

Yes, you can configure passwordless sudo for specific commands by adding NOPASSWD: in the sudoers file. For example: alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx. This is convenient but reduces security, so use it sparingly.

What does “sudo -i” do that “sudo -s” doesn’t?

sudo -i starts a login shell as root, which reads root’s environment files like .bashrc and .profile. sudo -s starts a non-login shell, preserving your current environment variables. Use -i when you want a clean root environment.

How do I add a user to sudo on Ubuntu?

Run sudo usermod -aG sudo username. The user must log out and back in for the change to take effect. On Fedora or RHEL, the group is wheel instead.

What if I forget my password and can’t use sudo?

If you have physical access to the machine, you can boot into recovery mode (on Ubuntu, hold Shift during boot) and reset the password from the root shell. On other systems, you may need to boot from a live USB and chroot into the installed system.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →