9

When I attempt to perform certain actions within ubuntu I am asked to authenticate with a root user, but ubuntu doesn't give me options for which root user, it just specifies it as the user that set up my machine. I was wondering how to go about changing which user it selects to run the authentication?

For instance, if I want to install software from the Ubuntu Software Center I am asked to authenticate with user X and I would like to change that to be user Y globally.

I am also aware that I can just run things with sudo from the command line, but I don't want to have to do that.

I'm using ubuntu 14.04. And user Y is in the sudoers file and as of now user X is not.

2
  • 1
    You will have to configure policy-kit to have user Y as an administrator as well. Then you'll be allowed to choose which user to use.
    – muru
    Oct 27, 2014 at 19:49
  • @muru can you provide some more info on this? I was under the impression that if the sudoers file has Y ALL=(ALL:ALL) ALL that is enough for user Y to have root privileges and run elevated tasks. What is this policy kit that you are referring to?
    – astrob0t
    Oct 27, 2014 at 20:09

3 Answers 3

19

For sometime now, sudoers has not been the only way to control user privileges on Ubuntu and other Linux distros. Polkit allows more fine-grained control of privileges. When you use GParted or Synaptic on a recent version of Ubuntu, authentication is usually done using polkit.

To set an user (say Y) as an administrator for polkit, create a file in /etc/polkit-1/localauthority.conf.d/ (say 99-custom.conf), containing:

[Configuration]
AdminIdentities=unix-user:Y

You can test whether this was applied correctly by using pkexec as Y:

$ pkexec bash -l
==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/bin/bash' as the super user
Authenticating as: muru,,, (muru)
Password: 
==== AUTHENTICATION COMPLETE ===

Since you already have an admin user, you will be offered a choice by pkexec:

$ pkexec bash
==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/bin/bash' as the super user
Multiple identities can be used for authentication:
 1.  X,,, (Y)
 2.  Y,,, (X)
Choose identity to authenticate as (1-2): 

The GUI should offer a drop-down list.

4
  • The default /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf contains the line AdminIdentities=unix-group:sudo;unix-group:admin, so making a user an administrator in the usual way--adding them to the sudo group--confers powers through polkit as well as sudo. (This is the case on Ubuntu 14.04 as well as newer releases.) Nov 1, 2017 at 19:55
  • It is necessary to relogin after the changes
    – sercxjo
    May 24, 2021 at 17:15
  • @sercxjo polkit configuration changes usually take effect immediately. However, if your change is dependent on groups and you just added the affected user to the relevant group, that user may need to re-login for the new group set to take effect.
    – muru
    May 25, 2021 at 15:21
  • @muru strange, I haven’t changed the groups and membership in them, but without relogin it didn’t work for me
    – sercxjo
    May 29, 2021 at 5:45
6

TL;DR: Adding the user to the sudo group with sudo usermod -aG sudo username solves this problem because both sudo and Polkit use that group.

The usual and expected way to give a user administrative powers on an Ubuntu system is to add the user's account to the sudo group. This gives them powers not just through sudo but through Polkit as well. The graphical prompt that lets you select between users with administrative powers is a Polkit prompt, not a sudo prompt. As muru says, most graphical programs that prompt you to enter a password to perform an administrative task are using Polkit, not sudo.

But to make a user an administrator, to allow them to perform actions as root with sudo and Polkit and so that they will appear in the list of users to authenticate as when using Polkit, you do not need to configure sudo and Polkit separately and I recommend against doing so. Just put the user in the sudo group. Don't be fooled by the name--Polkit respects this group just as sudo does.


The wording of your question very strongly suggests that, rather than adding the user to the Polkit group, you had added a custom entry for that one specific user in /etc/sudoers:

...it just specifies it as the user that set up my machine.

The user created when you install Ubuntu is added to the sudo group.

And you mentioned (emphasis mine):

And user Y is in the sudoers file and as of now user X is not.

Polkit does not use /etc/sudoers so giving a user the ability to run sudo by editing that file does not give them abilities through Polkit. That's a possible reason you might actually want to edit that file--if you wanted to give a user powers through sudo but not Polkit. However, you want both, and that's what the sudo group in Ubuntu is configured for already, so you should just use that.

Since you do have the ability to run commands as root with the sudo command, you can add username (replace it with the actual username, of course) to the sudo group by running:

sudo usermod -aG sudo username

Or if you want to use Polkit to add it, you can run this command, which has the exact same effect once it completes:

pkexec usermod -aG sudo username

After you run either of those commands, username will be able to perform arbitrary actions as root through both sudo and Polkit. Note that usermod needs the -a flag, as shown, or it will remove the user from other groups, which you do not want.

See also How to add existing user to an existing group?


In case you're interested in how both sudo and Polkit are set up to grant rights to users in the sudo group, the answer can be gleaned from their configuration files. By default, /etc/sudoers includes these lines:

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

/etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf consists of:

[Configuration]
AdminIdentities=unix-group:sudo;unix-group:admin

Thus both sudo and Polkit are configured to confer administrative privileges to users who are in either or both of the admin and sudo groups. The admin group is listed for compatibility with old versions of Ubuntu where admin was used instead of sudo, in case you upgrade from such a version and have user accounts in admin but not sudo. But aside from that situation, you likely don't even have an admin group. Running getent group admin sudo will show which of those groups exists and which users are in them. On a freshly installed 14.04 system, it won't show anything for admin. So use the sudo group, not the admin group, to make users administrators.

These configuration details are true of Ubuntu 14.04, as you were running when you asked this question, but also of all subsequent releases as of this writing, up to and including Ubuntu 17.10. Adding a user to the sudo group is the fully effective and most appropriate way to give them full sudo and Polkit powers, on all currently supported Ubuntu releases.


I'd like to acknowledge Videonauth both for the useful comment on another answer (that has since been deleted) that led to my writing this answer and for verifying that the information I've given about the contents of sudoers and 51-ubuntu-admin.conf is still accurate as of Ubuntu 17.10.

2

There is no such thing as default user for authentication. Its just that by default, the user created during installation of Ubuntu(in your case, X) is an administrator i.e., it is attached to the sudo group. So when you are performing elevated tasks like installation of softwares, you are asked for the password of the user in the sudo group.

Now when you add a new user Y, its by default a standard user and has to be manually added to sudo group or in general terms, made an administrator to install applications. Once the user is added to sudo group, you would be asked for the password of user Y when performing elevated tasks (when logged in as Y obviously).

2
  • 1
    I'm logged in as user Y right now who is in the sudoers file, but I still get asked for user X.
    – aplassard
    Oct 27, 2014 at 19:36
  • @aplassard This answer is correct. Having a user listed explicitly in /etc/sudoers is not the same, and does not have all the same effects, as adding the user to the sudo group. Only sudo, and not Polkit, uses /etc/sudoers, but both sudo and Polkit are configured to grant administrative rights to users in the sudo group. Even though the group's name is sudo, on Ubuntu that group is as related to Polkit as it is to the sudo command. I've posted an answer explaining this more fully. Nov 1, 2017 at 22:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .