In Linux environments, administrators may need to grant sudo privileges to multiple users. Instead of configuring sudo access individually for each user, it is more efficient to create a group and assign sudo privileges to that group. Any user added to the group will automatically inherit the configured sudo permissions.<\/p>\n\n\n\n
This article explains how to create a group, add users to the group, and grant sudo access to all members of the group.<\/p>\n\n\n\n
Before proceeding, ensure that you have:<\/p>\n\n\n\n
visudo<\/code>.<\/li>\n<\/ul>\n\n\n\nImplementation<\/h2>\n\n\n\nStep 1: Create a Group<\/h3>\n\n\n\n
Create a new group that will be used for sudo access:<\/p>\n\n\n\n$ groupadd testgroup<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nVerify the group:<\/p>\n\n\n\n$ getent group testgroup<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nStep 2: Add Users to the Group<\/h3>\n\n\n\n
Create users and add them to the group:<\/p>\n\n\n\n$ useradd -G testgroup username1
$ useradd -G testgroup username2<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nAlternatively, add existing users to the group:<\/p>\n\n\n\n$ usermod -aG testgroup username1
$ usermod -aG testgroup username2<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nVerify group membership:<\/p>\n\n\n\n$ id username1
$ id username2<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nStep 3: Edit the Sudoers File<\/h3>\n\n\n\n
Open the sudoers file using visudo<\/code>:<\/p>\n\n\n\nvisudo<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nAdd the following line at the end of the file:<\/p>\n\n\n\n
%testgroup ALL=(ALL) NOPASSWD: ALL<\/pre>\n\n\n\nReplace testgroup<\/code> with the actual group name.<\/p>\n\n\n\nExplanation<\/h4>\n\n\n\n\n%testgroup<\/code> \u00e2\u20ac\u201c Applies the rule to all users in the group.<\/li>\n\n\n\nALL=(ALL)<\/code> \u00e2\u20ac\u201c Allows execution of commands as any user.<\/li>\n\n\n\nNOPASSWD: ALL<\/code> \u00e2\u20ac\u201c Allows sudo commands without prompting for a password.<\/li>\n<\/ul>\n\n\n\nIf you want users to enter their password when using sudo, use:<\/p>\n\n\n\n
%testgroup ALL=(ALL) ALL<\/code><\/pre>\n\n\n\nStep 4: Test Sudo Access<\/h3>\n\n\n\n
Switch to a user in the group:<\/p>\n\n\n\n$ su \u2013 username1<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nVerify sudo access:<\/p>\n\n\n\n$ sudo whoami<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nExpected output:<\/p>\n\n\n\n
root<\/pre>\n\n\n\nConclusion<\/h2>\n\n\n\n
Using a dedicated group for sudo access simplifies administration when managing multiple users. By granting sudo permissions to a group, you can easily add or remove users without modifying the sudoers file each time. Always follow the principle of least privilege and grant sudo access only to trusted users. For improved security, consider requiring passwords for sudo operations instead of using the NOPASSWD<\/code> option.<\/p>\n\n\n\nFAQs<\/h2>\n\n\n\n1. Why should I use a group for sudo access?<\/h5>\n\n\n\n
Using a group makes sudo access easier to manage. Instead of adding sudo permissions individually for each user, you can grant permissions to the group and simply add or remove users from that group.<\/p>\n\n\n\n
2. How do I create a group for sudo access?<\/h5>\n\n\n\n
You can create a group using:<\/p>\n\n\n\n
groupadd testgroup<\/pre>\n\n\n\n3. How do I add an existing user to the sudo group?<\/h5>\n\n\n\n
Use the usermod<\/code> command:<\/p>\n\n\n\nusermod -aG testgroup username1<\/pre>\n\n\n\nThe -aG<\/code> option adds the user to the group without removing the user from their existing supplementary groups.<\/p>\n\n\n\n4. How can I verify whether a user belongs to the group?<\/h5>\n\n\n\n
Use the id<\/code> command:<\/p>\n\n\n\nid username1<\/pre>\n\n\n\nYou can also check the group directly:<\/p>\n\n\n\n
getent group testgroup<\/pre>\n\n\n\n5. What does %testgroup<\/code> mean in the sudoers file?<\/h5>\n\n\n\nThe %<\/code> symbol indicates that testgroup<\/code> is a group<\/strong>. Therefore:<\/p>\n\n\n\n%testgroup ALL=(ALL) NOPASSWD: ALL<\/pre>\n\n\n\napplies the sudo rule to all users who are members of testgroup<\/code>.<\/p>\n\n\n\n6. What is the difference between NOPASSWD: ALL<\/code> and ALL<\/code>?<\/h5>\n\n\n\nWith:<\/p>\n\n\n\n
%testgroup ALL=(ALL) NOPASSWD: ALL<\/pre>\n\n\n\nusers can execute sudo commands without entering their password.<\/p>\n\n\n\n
With:<\/p>\n\n\n\n
%testgroup ALL=(ALL) ALL<\/pre>\n\n\n\nusers will normally be prompted for their password when using sudo.\\<\/p>\n\n\n\n
Talk to our experts<\/h2>\n\n\n\n