Root and sudo

The superuser

One account, root (user ID 0), skips every permission check: it can read, change, or delete any file and change any setting ¹. That’s what system administration needs, and it’s exactly why you shouldn’t work as root day to day. A typo or a malicious program running as root can damage the whole system; running as an ordinary user, the damage stops at your own files ¹.

Unix has always separated users from administrators and handed out root’s power only when it’s needed. Windows’ habit of letting everyone run as administrator gives malware free rein; running Linux as root all the time throws away the main thing that protects it ¹.

How sudo works

Ubuntu locks the root account: it has a password hash that matches nothing, so nobody can log in as root ². Instead you put sudo (“superuser do”) in front of one command at a time ^{2 1}:

me@linuxbox:~$ apt update
E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)
me@linuxbox:~$ sudo apt update
[sudo: authenticate] Password:

• sudo asks for your own password, not root’s ^{2 1}.
• It checks the rules in /etc/sudoers to see whether you’re allowed to run that command ¹. On Ubuntu, members of the sudo group may run anything ².
• After you authenticate it trusts you for a few minutes (5 in the classic sudo’s default settings), so a string of sudo commands asks only once ^{3 1}.
• Every use is logged, so there’s a record of who did what as root ².

From Ubuntu 25.10 on, the sudo command is sudo-rs, a rewrite in the Rust language; it works the same way for ordinary use ².

Useful forms ¹:

me@linuxbox:~$ sudo -l              # what am I allowed to run?
me@linuxbox:~$ sudo -i              # a full root shell (prompt ends in #); exit to leave
me@linuxbox:~$ sudo -u sam ls ~sam   # run as some other user

Use sudo -i sparingly, for a burst of admin work, and exit as soon as you’re done.

su, the older way

su (“substitute user”) starts a shell as another user, by default root, and asks for that user’s password ¹. su - gives you root’s full login environment. Since Ubuntu’s root has no password, plain su doesn’t work there, and modern distributions have moved to sudo ^{1 2}. You’ll still see su - in older guides and on Fedora or Debian systems where a root password was set.

The redirection trap

This looks right and fails ⁴:

me@linuxbox:~$ sudo echo "Welcome to linuxbox" > /etc/motd
bash: /etc/motd: Permission denied

The > isn’t part of echo’s command. Redirection is done by your shell, which reads the whole line first, opens /etc/motd for writing, and only then starts sudo echo .... Your shell is running as you, so opening the file fails before sudo ever runs ⁴. The same goes for | and <: the shell does them, not the program.

The fix is to give root’s power to the program that opens the file ⁴:

me@linuxbox:~$ echo "Welcome to linuxbox" | sudo tee /etc/motd
me@linuxbox:~$ echo "one more line" | sudo tee -a /etc/motd     # -a appends

tee copies its input to a file (and to the screen); run with sudo, it’s the one opening the file, as root. Add > /dev/null if you don’t want the echo on screen.

Editing system files

To change a file in /etc, don’t run your editor as root. Use sudoedit (same as sudo -e) ⁵:

me@linuxbox:~$ sudoedit /etc/hosts

sudoedit copies the file somewhere you can write, opens your editor as you, and copies the result back as root when you save. Your editor, its plugins, and its settings never run as root ⁵. The editor it uses comes from the EDITOR variable (module 5); nano is the friendly default.

The sudo rules themselves, /etc/sudoers, are edited only with sudo visudo, which locks the file and refuses to save it with a syntax error ⁶. A broken sudoers file can lock you out of sudo entirely.

Users and the sudo group

Ubuntu’s own tools for accounts ²:

me@linuxbox:~$ sudo adduser sam               # new user, asks for a password and details
me@linuxbox:~$ sudo usermod -aG sudo sam      # give sam full sudo rights
me@linuxbox:~$ sudo passwd -l sam             # lock sam's password
me@linuxbox:~$ sudo deluser sam               # remove the account (the home folder stays)
me@linuxbox:~$ passwd                          # change your own password

The first account created when Ubuntu is installed (or the one you made when setting up WSL) is already in the sudo group ².

Your turn

So

Work as an ordinary user and borrow root’s power one command at a time with sudo, which asks for your own password and trusts you for a few minutes. Remember that redirection happens in your shell, so write root-owned files with sudo tee or sudoedit, and manage users with adduser, usermod -aG, and passwd.