In the previous chapter you learned about the concepts of users and groups, including the existence of a special user named root. Now it is time to understand how an ordinary user can safely perform administrative tasks. This chapter discusses root in more depth, the reasons why you are not advised to log in directly as root, and how to use the sudo command to temporarily obtain administrator privileges. You will also become familiar with the sudoers configuration file, the difference between the sudo group on Ubuntu and the wheel group on Fedora, and the su command for switching users.
What Is Root?
Root is the user account with UID 0 that has full, unrestricted power over the entire system. No file, command, or setting is off‑limits to root. This account can read any file, delete anything, change system configurations, and run commands that can permanently damage the system. In a common analogy, root can be thought of as a master key that opens every door in a building.
Because its authority is unlimited, root is not subject to the access permission checks that apply to ordinary users. This is why using root must always be done with caution and full awareness.
Why Is Logging in as Root Not Recommended?
Although powerful, logging in directly as root is strongly discouraged for daily work. There are several important reasons behind this advice.
- No safety net. When you work as root, every typing mistake can be fatal. A mis‑targeted deletion command could erase the entire system without warning, because root is not blocked by any permission checks.
- Difficult to trace responsibility. On a system used by many people, it is hard to know who ran a particular command if everyone logs in as the same root account.
- Risks from applications. Graphical applications run as root carry greater risk, because if such an application has a security vulnerability, the attacker will gain direct root access.
- The principle of least privilege. This security principle suggests that each person should be given only the minimum access rights needed to complete their task. Working as a regular user and elevating privileges only when needed is a practical application of this principle.
The safer approach is to work as an ordinary user and use sudo when you truly need administrative rights.
sudo: Running Commands as Administrator
sudo stands for superuser do. This command allows a normal user to run a command with root privileges, without having to log in as root. Simply prefix the command you want to run with the word sudo.
sudo apt update
sudo dnf install gimpWhen you run sudo for the first time, the system will ask for your own password, not the root password. After successful authentication, the permission is remembered for a short while (by default about 15 minutes), so subsequent sudo commands within that time period do not ask for a password again.
How sudo Works
sudo does not grant root power permanently, but only for the single command that accompanies it. After the command finishes, you return to being a regular user. This temporary nature makes sudo much safer than logging in as root, while also leaving a trail of executed commands in the system logs.
sudo-rs: A New Implementation in Ubuntu 26.04 LTS
Starting with Ubuntu 26.04 LTS "Resolute Raccoon", the sudo command you run is actually served by a new implementation called sudo-rs, a rewrite of sudo in the Rust programming language, designed to avoid the memory‑safety vulnerabilities that have appeared in the C version of sudo over the decades. Functionally, sudo-rs still reads the same /etc/sudoers file and supports common options like -i, -s, and -E in the same way as before, so almost all the material in this chapter remains unchanged.
There are two visual differences that might make you wonder when you first use it on Ubuntu 26.04 LTS.
- The password prompt now reads
[sudo: authenticate] Password:, different from the old prompt[sudo] password for username:. - The password characters are displayed as asterisks (
*) while you type, unlike the older version ofsudowhich displayed nothing. This behaviour can be disabled by adding the lineDefaults !pwfeedbackviavisudoif you do not want it.
The classic (C‑based) version of sudo is still installed on Ubuntu 26.04 LTS under the name sudo.ws, so you can switch back at any time using sudo update-alternatives --set sudo /usr/bin/sudo.ws if you encounter a need not yet supported by sudo-rs, such as sudoers authentication via LDAP. Fedora Workstation 44, on the other hand, still uses the classic sudo version as the default, so no similar visual differences appear on Fedora.
Configuration: /etc/sudoers and /etc/sudoers.d/
The rules about who may use sudo are stored in the /etc/sudoers file. This file is very sensitive, so you must not edit it with an ordinary editor. Use the visudo command instead, which checks for syntax errors before saving changes, preventing the system from becoming locked due to a corrupted file.
sudo visudoIn addition to the main file, there is a directory /etc/sudoers.d/ that contains additional configuration files. Software packages or administrators often place their rules here to avoid modifying the main file directly. Files in this directory should also be edited with visudo -f /etc/sudoers.d/filename so that their syntax is checked before saving.
sudo on Ubuntu: The sudo Group
On Ubuntu 26.04 LTS, the right to use sudo is granted through membership in the sudo group. The first user created during installation is automatically added to this group. To give sudo rights to another user, add them to the sudo group.
sudo usermod -aG sudo budisudo on Fedora: The wheel Group
Fedora Workstation 44 uses a similar mechanism, but with a different group name, namely the wheel group. As on Ubuntu, the first user created during installation is already a member of this group. To give sudo rights to another user on Fedora, use the following command.
sudo usermod -aG wheel budiBoth the sudo group on Ubuntu and the wheel group on Fedora essentially serve the same function, differing only in naming heritage from the traditions of each distribution family. After adding a user to one of these groups, they need to log out and log back in (or open a new terminal session) for the new group membership to be recognised by the system.
su: Switching Users
Besides sudo, there is the su command, which stands for switch user or substitute user. This command is used to switch to another user account. Without arguments, su switches to the root account, whereas with a username, you can switch to that account.
su -
su - budiThe hyphen (-) after su is useful because it fully loads the target user's environment, including their home directory and environment variables. Without the hyphen, you only switch identities but remain in the previous user's environment.
An important difference between su and sudo lies in the password they ask for. sudo asks for your own password, whereas su asks for the password of the target account. This is why sudo is more commonly used on modern desktop distributions, as administrators do not need to share the root password with many people. Note that the su command you use on Ubuntu 26.04 LTS and Fedora Workstation 44 still uses the old implementation (from the util-linux package) even though sudo has switched to sudo-rs, so the behaviour of su described above remains unchanged.
Understanding root, sudo, and su is the key to working safely and responsibly on Linux. Following the principle of least privilege, you carry out your daily activities as an ordinary user and only elevate your access rights via sudo when necessary. This foundation will be directly used in the next chapter, when you learn about read, write, and execute permissions on files and how to change file ownership and permissions.