In the previous chapter, we explored the concept of users and groups, including the existence of a privileged user named root. Now it is time to understand how a standard user can safely execute administrative tasks. This chapter covers root in more depth, the reasons why logging in directly as root is discouraged, and how to use the sudo command to temporarily gain administrator privileges. We will also look into the sudoers configuration file, the difference between the sudo group in Ubuntu and the wheel group in Fedora, and the su command for switching users.
22.1 What Is Root?
Root is the user account with UID 0 that possesses full, unlimited authority over the entire system. No files, commands, or settings are off-limits to root. This account can read any file, delete anything, modify system configurations, and run commands that can permanently damage the system. In an everyday analogy, root can be thought of as a master key that opens every door in a building.
Because of its unlimited power, root is not subject to the access permission checks that apply to standard users. This is why using root must always be done carefully and with full awareness.
22.2 Why Is Logging In as Root Discouraged?
Although powerful, logging in directly as root is strongly discouraged for daily work. There are several important reasons behind this recommendation.
- No safety net. When working as root, every typo can lead to fatal consequences. A misdirected delete command could wipe the entire system without warning, as root is never blocked by any permission system.
- Difficult accountability tracking. On a multi-user system, it is difficult to know who executed a specific command if everyone logs in as the same root user.
- Risks from applications. Graphical applications executed as root carry greater risks because if an application contains security vulnerabilities, an attacker will instantly gain full root access.
- Principle of least privilege. This security principle suggests that everyone should only be granted the minimum access privileges required to complete their tasks. Working as a standard user and elevating privileges only when necessary is a practical implementation of this principle.
A safer approach is to work as a standard user and use sudo when administrative privileges are genuinely required.
22.3 sudo: Running Commands as Administrator
sudo stands for superuser do. This command allows a standard user to execute a command with root privileges without needing to log in as root. Simply prefix the intended command with the word sudo.
sudo apt update
sudo dnf install gimpWhen executing sudo for the first time, the system prompts for our own password, not the root password. Upon successful authentication, the permission is temporarily cached (by default for around 15 minutes), so subsequent sudo commands within that window do not require entering the password again.
22.3.1 How sudo Works
sudo does not grant permanent root power; instead, it applies only to the single command accompanying it. Once the command completes, we return to being a standard user. This temporary nature makes sudo far safer than logging in as root, while also leaving an audit trail of executed commands in the system logs.
22.3.2 sudo-rs: A New Implementation in Ubuntu 26.04 LTS
Starting with Ubuntu 26.04 LTS "Resolute Raccoon", the sudo command we execute is actually served by a new implementation called sudo-rs, which is a rewrite of sudo in Rust designed to avoid memory safety vulnerabilities that affected the C implementation of sudo for decades. Functionally, sudo-rs continues to read the same /etc/sudoers file and supports common options like -i, -s, and -E in the exact same manner as before, meaning nearly all material in this chapter remains valid without modification.
There are two visual differences that might raise questions when first using it in Ubuntu 26.04 LTS.
- The password prompt now reads
[sudo: authenticate] Password:, differing from the legacy prompt[sudo] password for username:. - Password characters are displayed as asterisks (
*) while typing, unlike the legacy version ofsudowhich displayed nothing. This behavior can be disabled by adding the lineDefaults !pwfeedbackviavisudoif desired.
The classic (C-based) version of sudo remains installed in Ubuntu 26.04 LTS under the name sudo.ws, allowing us to switch back at any time via sudo update-alternatives --set sudo /usr/bin/sudo.ws if encountering requirements not yet supported by sudo-rs, such as sudoers authentication via LDAP. Meanwhile, Fedora Workstation 44 in this release still uses classic sudo as default, so no similar visual differences exist in Fedora.
22.3.3 Configuring /etc/sudoers and /etc/sudoers.d/
Rules regarding who is allowed to use sudo are stored in the /etc/sudoers file. This file is extremely sensitive, so it must not be edited using a standard text editor. Use the visudo command, which performs syntax checking before saving changes, preventing system lockouts caused by corrupted files.
sudo visudoIn addition to the main file, there is an /etc/sudoers.d/ directory containing supplementary configuration files. Software packages or administrators often place their rules here to avoid modifying the main file directly. Files within this directory should also be edited using visudo -f /etc/sudoers.d/filename to ensure syntax is validated prior to saving.
In practice, sysadmins commonly use the sudo -l command to inspect the sudo access privileges of the currently logged-in user. This command displays the list of applicable rules for that user according to the contents of /etc/sudoers and /etc/sudoers.d/, which is much faster than re-reading all configuration files individually, especially on systems with many custom rules.
sudo -l22.3.4 sudo in Ubuntu: The sudo Group
In Ubuntu 26.04 LTS, rights to use sudo are granted through membership in the sudo group. The first user created during installation is automatically added to this group. To grant sudo privileges to another user, add them to the sudo group.
sudo usermod -aG sudo budi22.3.5 sudo in Fedora: The wheel Group
Fedora Workstation 44 uses a similar mechanism, but with a different group name: the wheel group. Just like Ubuntu, the initial user created during installation is already a member of this group. To grant sudo privileges to another user in Fedora, use the following command.
sudo usermod -aG wheel budiBoth the sudo group in Ubuntu and the wheel group in Fedora perform the same fundamental function, differing only in naming due to legacy traditions from their respective distribution families. After adding a user to either group, they must log out and log back in (or open a new terminal session) for the new group membership to be recognized by the system. To verify that group membership has been registered, run groups budi after starting a new session; the sudo or wheel group name will appear in the list if successful.
22.4 su: Switching Users
Besides sudo, there is the su command, which stands for switch user or substitute user. This command is used to switch to another user account. Without arguments, su switches to the root account, whereas specifying a username allows switching to that particular account.
su -
su - budiThe hyphen (-) after su is useful for fully loading the target user's environment, including their home directory and environment variables. Without the hyphen, identity switches while remaining within the previous user's environment context.
An important distinction between su and sudo lies in the password requested. sudo asks for our own password, while su asks for the target account's password. For this reason, sudo is more commonly used in modern desktop distributions, as administrators do not need to share the root password with multiple people. Note that the su command used in both Ubuntu 26.04 LTS and Fedora Workstation 44 still uses the legacy implementation (from the util-linux package) even though sudo has transitioned to sudo-rs, so the behavior of su described above remains unchanged.
Understanding root, sudo, and su is key to working safely and responsibly in Linux. In line with the principle of least privilege, daily activities are carried out as a standard user, elevating privileges through sudo only when necessary. This knowledge will be directly applied in the next chapter, where we will study read, write, and execute permissions on files as well as how to modify file ownership and permissions.