What is the difference between sudo and root?

Root is the all-powerful superuser account (user ID 0) that can do anything on the system. sudo is a tool that lets a permitted normal user run individual commands as root (or another user) after entering their own password, without logging in as root or knowing the root password. sudo also logs who ran what, so it gives you root-level power for a single command with an audit trail, rather than a full root session.

Why does sudo not ask for my password again right away?

After a successful sudo, most distributions cache your authentication for a short grace period — commonly 15 minutes — so repeated sudo commands in the same terminal do not re-prompt. The exact timeout is set by the timestamp_timeout option in the sudoers file and varies by distribution. You can clear the cached credentials immediately with sudo -k, which forces a password prompt on your next sudo command.

How do I add a user to sudo?

On Debian and Ubuntu, add the account to the sudo group with sudo usermod -aG sudo username. On Fedora, RHEL, Arch, and openSUSE the group is called wheel, so use sudo usermod -aG wheel username. The user must log out and back in for the new group membership to take effect. This works only if that group is already enabled in the sudoers file, which it is by default on those distributions.

Why should I not just run everything as root?

Running as root removes the safety net: there are no permission checks to stop a typo, a bad script, or malware from deleting system files or damaging the whole machine. sudo limits root power to the single command you intend, prompts for your password, and records the action in the logs. Using sudo for the specific commands that need it — and running everything else as your normal user — dramatically reduces the blast radius of mistakes.

How to Use sudo on Linux

The word itself is short for superuser do. You put it in front of a command, and only that command runs with administrative rights:

sudo apt update

That single word is one of the most important habits in Linux. It lets you make system-wide changes — installing software, editing protected files, managing services — without permanently logging in as the all-powerful root account. Below is how sudo works, the syntax you will actually use, how it differs from su, how the sudoers group and password timeout behave, and how to change who can use it safely.

sudo vs. root: what is really happening

Root (user ID 0, also called the superuser) is the account that can do anything on a Linux system — read, change or delete any file, and control every process. sudo ("superuser do") is a program that lets a permitted normal user run an individual command as root (or as another user) after authenticating with their own password. The differences that matter day to day:

You use your own password, not root's. On Ubuntu and many other desktop distributions the root account has no usable password at all — as Ubuntu's server documentation spells out, sudo is the intended way in.
Privilege is per-command. The elevated rights apply to that one command and then you are back to your normal, unprivileged self.
Everything is logged. sudo records who ran what and when (typically to the system journal or /var/log/auth.log), giving you an audit trail.

Tip — check what a command will do before running it as root

Want to see which privileges you have without running anything destructive? Run sudo -l to list the commands your account is allowed to run through sudo, as the sudo(8) manual page describes. And sudo -v refreshes your cached credentials (the password grace period) without executing a command.

The basic syntax

The general form is simply:

sudo COMMAND [arguments]

A few patterns you will reach for constantly:

Run one command as root:
```
sudo systemctl restart NetworkManager
```
Edit a protected file (use your normal editor with elevated rights):
```
sudo nano /etc/hosts
```
Re-run the previous command with sudo when you forgot it and hit "Permission denied". The !! expands to your last command:
```
sudo !!
```
Run a command as a specific user (not root) with -u:
```
sudo -u postgres psql
```

Caution — piping and redirection are not elevated

In sudo echo text > /etc/somefile, only echo runs as root — the > redirect is handled by your normal shell and will fail with "Permission denied". Use sudo tee instead:

echo "text" | sudo tee /etc/somefile

Or open a root shell for the whole job (see below). This is one of the most common sudo mistakes.

sudo -i, sudo -s, and su: getting a root shell

Sometimes you need to run several commands as root. Rather than typing sudo dozens of times, open a root shell — but choose the right one:

sudo -i — start a login shell as root. This reads root's login environment and switches to root's home directory, closely matching a real root login. This is usually the cleanest way to "become root" on a sudo-based system.
sudo -s — start a non-login shell as root while keeping most of your current environment. Handy when you want root privileges but your existing settings.
su - — the traditional "switch user" command. With no name it switches to root and su - gives a login shell. The catch: su asks for the root account's password, which does not exist on distributions like Ubuntu, so su fails there by design. sudo -i is the modern replacement.

When you are done in a root shell, type exit (or press Ctrl+D) to return to your normal user. Your prompt usually ends in # as root and $ as a normal user — a useful visual reminder.

Caution — the commands that bite hardest as root

As root there is no safety net. Treat these with extra care:

rm -rf deletes files and directories with no confirmation and no recycle bin. Double- check the path before pressing Enter, especially anything with a leading / or a variable like $VAR that could be empty.
Partitioning and disk tools such as fdisk, parted, mkfs and dd can wipe an entire drive instantly if you target the wrong device (e.g. /dev/sda). Confirm the device name with lsblk first.
Never paste a command you do not understand into a root shell — a single line can compromise the whole machine.

The sudoers group and password prompts

Who is allowed to use sudo is decided by the /etc/sudoers configuration and, in practice, by membership in an administrator group. The group name depends on your distribution family:

Debian / Ubuntu / Linux Mint: the group is sudo.
Fedora / RHEL / CentOS / Rocky / AlmaLinux / Arch / openSUSE: the group is wheel.

To grant an existing user administrative rights, add them to that group and have them log out and back in:

# Debian / Ubuntu
sudo usermod -aG sudo alice

# Fedora / RHEL / Arch / openSUSE
sudo usermod -aG wheel alice

Confirm the change with groups alice (after they re-log in) or id alice.

On Arch Linux in particular, sudo is not installed by default and the wheel rule is disabled out of the box. Install it and enable wheel via visudo (next section):

pacman -S sudo

The password prompt and its timeout. The first time you run sudo in a terminal it asks for your password. After a successful authentication, sudo caches it for a short grace period so repeated commands do not keep prompting you. This timeout is controlled by the timestamp_timeout option in sudoers and defaults to 5 minutes, though a distribution or administrator can change it. Useful controls:

sudo -k — forget the cached credentials now, forcing a password prompt next time.
sudo -v — extend the grace period without running a command.

Editing sudoers safely with visudo

You should never open /etc/sudoers directly in a text editor. A single syntax error there can lock you out of sudo entirely — leaving you unable to fix it. The correct tool is visudo, which edits a temporary copy, checks the syntax before saving, and only installs the change if it parses cleanly — the visudo(8) manual page describes it as locking sudoers against simultaneous edits and checking for syntax errors before installing the edited file:

Open the file with:
```
sudo visudo
```
To enable the administrator group, find and uncomment (remove the leading #) the relevant line. On wheel-based systems it looks like:
```
%wheel ALL=(ALL:ALL) ALL
```
On Debian/Ubuntu the equivalent line for the sudo group is already active:
```
%sudo ALL=(ALL:ALL) ALL
```
Save and exit. On a default install this opens in nano (Ctrl+O to save, Ctrl+X to exit); if it opens in vi, press Esc then type :wq. To force a specific editor, set EDITOR, e.g. sudo EDITOR=nano visudo.
If visudo reports an error, choose e to re-edit rather than saving a broken file.

For per-user or per-app rules, prefer a drop-in file in /etc/sudoers.d/ instead of editing the main file — and still create it with visudo so it is syntax-checked:

sudo visudo -f /etc/sudoers.d/alice

Caution — keep a second session open

Whenever you change sudo rules, keep an existing root or sudo session open in another terminal until you have confirmed the new rule works. If you do lock yourself out, you may need to boot into recovery mode to repair /etc/sudoers.

Why not run everything as root?

It is tempting to open a root shell and stay there. Resist it. Running as your normal user means the system's permission checks are working for you: a mistyped path, a buggy script, or malicious code is stopped at the boundary of what your account can touch. sudo deliberately narrows root power to the one command that genuinely needs it, prompts for confirmation, and leaves a record. Use sudo for the specific administrative task, then get back to being a normal user — that single discipline prevents most catastrophic Linux mistakes.