Use sudo to delegate only the administrative actions a user needs, and use visudo for every policy change. On a Linux VPS, the sudoers policy determines who may run which command, on which host, as which target user or group, and whether authentication or logging rules apply. A safe change keeps a working root or second administrator session open, validates the complete policy, and is tested from a separate session before the old access path is closed.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What sudo and sudoers control
sudo is not itself an access list. It asks a configured security policy whether a command is authorized, then runs an approved command with the selected privileges. The usual local policy is the sudoers policy, normally read from /etc/sudoers and any files included by it. The policy can also control authentication, environment handling, credential timestamp caching, command logging, and terminal input/output logging.
As an Amazon Associate I earn from qualifying purchases.
That makes sudoers a privilege boundary rather than a convenience setting. A rule that appears to permit one service action can become a route to a shell if the permitted program can edit arbitrary files, execute another program, load plugins, or interpret user-controlled configuration. Evaluate the behavior of the executable, not just its name.
Keep a recovery path before changing access
Policy mistakes can lock out every administrator. Before editing, keep the current root shell or a second administrative SSH session open. If your VPS provider offers an out-of-band console or rescue mode, verify that you can use it. Do not close the known-good session until the new login and both positive and negative authorization tests have succeeded.
#1 Best Overall
- Record the user or group that should receive access, the business or operational reason, the owner of the rule, and the rollback action.
- Confirm which account currently has root access and whether another account can repair
/etc/sudoers. - Note the distribution’s policy locations. Do not assume that a file in
/etc/sudoers.d/is active unless the main policy includes that directory.
Understand the sudoers rule fields
A rule identifies a user or group, a host, an optional run-as user and group, and one or more commands. This schematic rule grants the ops Unix group permission to restart Nginx as root:
%ops ALL=(root) /usr/bin/systemctl restart nginx| Field | Meaning in this example |
|---|---|
%ops |
The Unix group named ops. Without the percent sign, ops would name a user. |
ALL |
The host restriction. It matches any host name represented in the policy; use a narrower host list when the same policy is distributed to several machines. |
(root) |
The command may run as the root user. A run-as group can be added after a colon when required. |
/usr/bin/systemctl restart nginx |
The permitted command and argument pattern. The path must match the installed system, and the arguments are part of the security decision. |
Rules can name an individual user instead of a group, permit a small command set, or use broader forms such as ALL. Broad grants are sometimes operationally necessary, but they should be an explicit, documented decision rather than a default.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsChoose the smallest useful permission
| Design | When it fits | Main risk or cost |
|---|---|---|
| Named user | One operator needs a temporary or individual permission. | Membership and off-boarding must be maintained per account. |
| Unix group | A stable team needs the same permission set. | Every group member receives the rule; review membership as carefully as the rule. |
| One exact command | A repeatable task such as restarting one service. | The executable’s own features may still provide indirect privilege. |
| Small command set | A defined operational role needs several related actions. | Each path and argument pattern must be reviewed. |
| Unrestricted execution | Full administration is genuinely required and accountable. | A user can act as root; logging and access review become especially important. |
Use absolute executable paths. Prefer fixed arguments where possible. Treat argument wildcards, command aliases that hide a large set, and unrestricted ALL entries as exceptions requiring a reason and review. A rule with NOPASSWD skips the normal password prompt for the matched command; use it only when the automation or operational need is clear and the resulting risk is accepted. Password caching can also make a previously authenticated decision remain valid for the policy’s timestamp period, so consider the host’s authentication and timeout settings when assessing exposure.
Edit the policy with visudo
The visudo manual describes the utility as editing sudoers “in a safe fashion, analogous to vipw(8).” It locks the policy while editing, checks ownership and permissions, parses the result, and refuses to install a syntax-invalid file. Directly opening /etc/sudoers in a text editor is not the normal workflow.
- Inspect the current policy and its include directives from the protected session. For example, display the beginning of the file and look for
Includeor@includedirlines. Confirm whether local rules belong in the main file or an included directory. - For a central change, run
sudo visudo. The editor is selected by the host’s editor settings; save and exit in the usual way for that editor. - Add a rule with an explicit subject, host, run-as target, and command path. Keep comments factual: state the purpose, owner, and review or removal condition.
- Let visudo parse the result. If it reports an error, choose the option to continue editing, correct the line, and validate again. Do not install a file while any parse error remains.
For a separate policy fragment, create or edit it through visudo’s file mode rather than writing an unchecked file. A typical check is:
sudo visudo -cf /etc/sudoers.d/ops-nginxThe -c option checks syntax and -f selects the file. A successful check of one fragment does not replace validation of the complete policy: inclusion order, conflicting rules, ownership, permissions, and other files can change the effective result.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use an included directory without bypassing review
A main sudoers file can include a directory such as /etc/sudoers.d/. This keeps site-specific rules modular and makes code review or configuration management easier. It does not create a second, less trusted policy: every included file is parsed as part of the active configuration.
- Use predictable, descriptive filenames and restrictive ownership and permissions appropriate to sudoers policy. Ordinary users must not be able to modify the file or its parent directory.
- Keep one logical role or service per file so that a rule can be reviewed and rolled back without editing unrelated policy.
- Validate the complete configuration after adding, removing, or renaming an include. An apparently harmless file can fail the entire parse if it contains invalid syntax.
- Use configuration management or peer review where available, and retain the reason and rollback path with the change.
Validate the effective result
Syntax validation answers “can sudoers be parsed?” It does not answer “does this user receive exactly the intended access?” Perform both checks.
- From the protected session, run
sudo visudo -cto check the policy. Resolve every error before testing access. - As the target account, run
sudo -lto list that account’s effective permissions. An administrator can inspect another account withsudo -l -U username, subject to the current policy. - Open a separate SSH session as the target user. Test the command that should work, such as
sudo /usr/bin/systemctl restart nginx, using the exact path and arguments in the rule. - Test a nearby command that must remain denied, such as a different service action or an interactive shell. A denial confirms that the boundary is narrower than full root access.
- Check event records and, where enabled, input/output logs. Record the observed result and close the recovery session only after the new path is dependable.
Logging, auditing, and privacy
Sudoers logs successful and unsuccessful attempts and policy errors by default, with syslog and local-file destinations configurable. These records show authorization events and are useful for detecting failed access, investigating changes, and proving which account requested an action.
Rank #4
When configured, sudo I/O logging can capture terminal input and output or standard streams, with storage kept locally or sent to a remote service. Decide what must be retained, how long it should be kept, who may read it, and how it is protected from the administrators whose activity it records. Logging is not a substitute for least privilege: an unrestricted rule can still permit damaging actions before an alert is reviewed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failure modes and recovery
“sudo: parse error” or visudo refuses the file
Return to the editor, correct the reported line, and rerun validation. Check punctuation, parentheses, command paths, and continuation lines. Do not work around the error by copying the file into place with another command.
The rule parses but the command is denied
Run sudo -l as the target user and compare the displayed rule with the command actually typed. Confirm the executable path, arguments, host match, run-as target, group membership, and whether the user has started a new login session after a group change.
Best Value
The command is allowed but grants more power than intended
Inspect the program’s ability to invoke shells, edit arbitrary files, load plugins, or read attacker-controlled configuration. Replace a broad argument pattern with fixed arguments or a narrowly constrained wrapper whose behavior is understood and maintained.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →An included rule has no effect
Confirm that the main policy includes the directory, that the file is readable with the expected ownership and permissions, and that the complete policy passes sudo visudo -c. A fragment outside an active include path is just an unused file; a malformed fragment can make validation fail.
An administrator is locked out
Keep the original root or second administrator session open during changes. If it is already closed, use the VPS provider’s out-of-band console or rescue procedure, restore the last known-good policy, and validate it before attempting a narrower change.
A repeatable change checklist
- Define the task, subject, run-as identity, exact command path and arguments.
- Choose a user or group and document why that scope is appropriate.
- Decide whether password authentication, cached credentials, or a reviewed
NOPASSWDtag is required. - Preserve a recovery session and verify the VPS console path.
- Edit with
visudo, or validate a fragment with its file-check mode. - Validate the complete policy and review ownership, permissions, and includes.
- Test one allowed and one denied action from a separate session.
- Review sudo event and I/O records, then record the owner and rollback date.
The Bottom Line
Use sudoers as a deliberately narrow policy: edit only with visudo, grant the smallest command set with explicit paths and arguments, validate the complete include tree, test from a separate session, and review the resulting logs. That workflow preserves a recoverable VPS while making administrative access auditable and understandable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
