What is sudo?
On Linux and macOS, most administrative work, such as installing packages, editing files under /etc or restarting services, needs root privileges. Instead of signing in as root, an authorized user puts sudo in front of the one command that needs elevation:
sudo apt updaterefreshes package lists on Ubuntu or Debiansudo systemctl restart cupsrestarts the print servicesudo nano /etc/hostsedits a protected file
The user types their own password, not root's. sudo then remembers that approval for a few minutes (the timeout depends on the system), so a run of admin commands does not prompt every time. When the command finishes, the user is back to normal privileges.
Who can use sudo
Permission comes from the sudoers policy in /etc/sudoers and files under /etc/sudoers.d/. Most distributions give full sudo rights to a group: sudo on Debian and Ubuntu, wheel on Fedora and Red Hat systems. On Ubuntu, an admin grants it with sudo usermod -aG sudo username. On macOS, members of the admin group can use sudo. Edit the policy only with visudo, which checks the syntax before saving; a typo made in a normal editor can leave nobody able to use sudo. A user without permission gets a message saying they are not in the sudoers file.
Useful options
| Command | What it does |
|---|---|
sudo -l | Lists what the current user is allowed to run |
sudo -u alice command | Runs the command as user alice instead of root |
sudo -i | Opens a root login shell; use it sparingly |
sudo -k | Discards the remembered approval so the next sudo asks again |
sudo !! | A Bash shortcut that repeats the previous command with sudo, handy after a "Permission denied" error |
sudo vs su
| sudo | su | |
|---|---|---|
| Scope | One command at a time | A whole shell session as another user |
| Password | Your own | The target account's (root's by default) |
| Control | Policy can limit users to specific commands | Full access to the target account |
| Logging | Each command is logged with the user's name | The switch is logged, not each command |
su -, with the dash, starts a full login shell with the target user's environment. Ubuntu ships with the root password locked, so su to root fails there unless a root password is set; sudo -i is the usual route instead. Watch the prompt: $ usually means a normal user and # means root.
Security and troubleshooting
- Least privilege: elevate only the command that needs it. Running a downloaded script with sudo gives it full control of the system, so read it first.
- Audit trail: sudo use is logged, typically in
/var/log/auth.logon Debian and Ubuntu,/var/log/secureon Red Hat systems, or the systemd journal (journalctl). - "Permission denied" or "are you root?": the command needs elevation, so run it again with sudo.
- "command not found" only under sudo: sudo often uses a restricted
PATH, so give the full path to the program.
Windows comparison
The Windows counterpart is User Account Control. An administrator works with standard rights and approves elevation per task, for example with Run as administrator, and the runas command starts a program as another account. Recent Windows 11 releases also include an optional sudo command that can be turned on in the developer settings.
sudo on the CompTIA A+ exam
sudo is listed under Core 2 (220-1202) objective 1.9, Linux basics and everyday commands. Know that it runs a single command with elevated rights using your own password, that su switches the whole session and needs the target account's password, and that package commands such as apt install and dnf install need sudo. If a scenario shows "Permission denied" when a standard user runs an admin command, think sudo. If it asks for the Linux version of Run as administrator, the answer is also sudo.