Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How does the ubuntu user on the AWS images for Ubuntu Server 12.04 have passwordless sudo for all commands when there is no configuration for it in /etc/sudoers?

I'm using Ubuntu server 12.04 on Amazon. I want to add a new user that has the same behavior as the default Ubuntu user. Specifically I want passwordless sudo for this new user.

So I've added a new user and went to edit /etc/sudoers (using visudo of course). From reading that file it seemed like the default ubuntu user was getting it's passwordless sudo from being a member of the admin group. So I added my new user to that. Which didn't work. Then I tried adding the NOPASSWD directive to sudoers. Which also didn't work.

Anyway, now I'm just curious. How does the ubuntu user get passwordless privileges if they aren't defined in /etc/sudoers. What is the mechanism that allows this?

share|improve this question
up vote 162 down vote accepted

Okay, I have discovered the answer so may as well put it here for completeness. At the end of /etc/sudoers there is what I thought was just a comment:

#includedir /etc/sudoers.d

However this actually includes the contents of that directory. Inside of which is the file /etc/sudoers.d/90-cloudimg-ubuntu. Which has the expected contents

# ubuntu user is default user in cloud-images.
# It needs passwordless sudo functionality.

So that is where the sudo configuration for the default ubuntu user lives.

You should edit this file using visudo. The following command will let you edit the correct file with visudo.

sudo visudo -f /etc/sudoers.d/90-cloudimg-ubuntu

And add a line like:


At the end.

share|improve this answer
I am currently struggling with /etc/sudoers on ubuntu-12.04 (desk x86_64). After altering /etc/sudoers or /etc/sudoers.d/*, do I need to reboot, logout or sudo restart any daemon? – m-ric Feb 14 '13 at 16:11
I'm pretty sure I had to do a full reboot. – aychedee Feb 14 '13 at 20:40
new sudo rules will be used for every new logged user - so you need re login at least – bluszcz Feb 27 '13 at 10:17
'sudo service sudo restart' works :) – Laice Jun 11 '13 at 2:23
In later versions (14.04 for example) the included file is /etc/sudoers.d/90-cloud-init-users (so to edit.. sudo visudo -f /etc/sudoers.d/90-cloud-init-users). Although it'd be cleaner to create additional files than editing the generated one. Note that files containing a . or ending in ~ will not be included. – Molomby Aug 27 '15 at 5:29

I found that the most straight forward thing to do, in order to easily replicate this behavior across multiple servers, was the following:

sudo visudo

Change this line:

# Members of the admin group may gain root privileges
%admin  ALL=(ALL) ALL

to this line:

# Members of the admin group may gain root privileges

And move it under this line:

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

you should now have this:

# This file MUST be edited with the 'visudo' command as root.
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
# See the man page for details on how to write a sudoers file.

Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

then for every user that needs sudo access WITH a password:

sudo adduser <user> sudo

and for every user that needs sudo access WITH NO password:

sudo adduser <user> admin

and finally, run this:

sudo service sudo restart

And that's it!

Edit: You may have to add the admin group as I don't think it exists by default.

sudo groupadd admin

You can also add the deafult AWS ubuntu user to the admin group via this command:

sudo usermod ubuntu -g admin
share|improve this answer
Note to self: It's a convention to move less restrictive permissions lower in the stack. But not doing it won't affect functionality. – poweratom Sep 5 '14 at 9:47

Short answer without using any editor (tested on bash, very risky to execute on remote hosts)

Set sudo without password for the current user

sudo echo "$USER ALL=(ALL) NOPASSWD:ALL" | sudo tee -a /etc/sudoers

Verify if you can use sudo without password ...

sudo cat /etc/sudoers | grep "$USER"

.. or simply try it with

sudo <anything>
share|improve this answer
This is pretty dangerous advice... copy and paste this wrong and you'll lock yourself out of your own server. Hence the advice to use visudo. It checks that the syntax is correct before saving to disk. So, for anyone that wants to use this. Don't do it on a remote server that you care about. You might want to include a warning about that in your answer. – aychedee Aug 14 '14 at 9:25
For a non-permanent solution, that works. – jiminikiz Sep 10 '14 at 16:47
Not using visudo is a horrible idea. Trust me, I know. – Bailey S Sep 9 '15 at 17:22
IMHO, a copy-paste is safer than a manual edit. A minor simplification: echo "$USER ALL=(ALL) NOPASSWD:ALL" | sudo tee -a /etc/sudoers – theartofrain Apr 5 at 23:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.