---
title: sudo — Privilege delegation execution
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A tool that runs specific commands with administrator privileges from a regular account. Checking the privilege policy is key.
tags: program, User and Security Management, sudo
---

**💬 "sudo command"**

sudo lets you run **only the commands you need with administrator privileges**. It is the standard way to reduce direct root logins.

Policies are managed in /etc/sudoers and /etc/sudoers.d and are edited with `visudo`.

- **Concept**: Runs allowed commands with another user's privileges (root by default).
- **-l**: View the list of commands the current account can run.
- **-u**: Specify the user to run as.
- **Policy**: Manage through files in /etc/sudoers.d/.
## Frequently used options

| Option | Description |
| --- | --- |
| sudo -l | View allowed command list |
| sudo -u <user> <command> | Run with another user's privileges |
| visudo -c | Check sudoers syntax |
| sudo -n | Run without a password (for automation) |

## Three essential command combinations

- `sudo -l` — Check which administrator commands I can use
- `sudo -n systemctl status nginx` — Check whether status can be checked without a password
- `visudo -c` — Validate sudoers file syntax
**💬 "Tell me one way to use it while saving resources."**

Common situations on production servers are organized in order.

### Step 1 · Check permissions

See what you can do with sudo.

```
sudo -l
```

### Step 2 · Execute

Run only the necessary command with administrator privileges.

```
sudo systemctl restart nginx
```

### Step 3 · Audit

Check sudo usage records.

```
journalctl -t sudo -n 20 --no-pager
```

## How it is used in practice

### 1. Deployment automation privileges

**Situation** — CI should only use sudo to restart services.

```
grep -r ci-deploy /etc/sudoers.d/ && sudo -n systemctl restart myapp
```

**Result** — Only allowed commands run without a password.

**Point** — It is safer to allow only the necessary commands instead of full ALL privileges.

### 2. sudo auditing

**Situation** — Check who ran administrator commands.

```
journalctl -t sudo --since today --no-pager | tail -20
```

**Result** — User, command, and time are recorded and used for auditing.

**Point** — Also check sudo usage by automation accounts.

## Important notes

- NOPASSWD ALL is effectively the same as root. Restrict commands to the minimum.
- Directly editing sudoers can block sudo itself due to a syntax error, so always use visudo.
- Run commands that affect production only after an approval process.
## Actual execution screen

This shows the result of confirming the allowed sudo command list and passwordless execution.

![sudo command execution result: allowed command list and execution](https://games.aidebatehub.com/assets/sudo-demo.png)

Live production server

---
Source (HTML): https://games.aidebatehub.com/programs/linux/security/sudo.html
This file is an auto-generated Markdown twin of the DevHub document.