Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


This is a fairly complex question related to the Sudoers file and the sudo command in general.

NOTE: I have made these changes on a dedicated machine running Ubuntu Desktop 13.04, that I use purely for learning purposes. I understand it's a huge security risk to enable NOPASSWD sudo.


Initially, my only change to the sudoers file (/etc/sudoers) was one line, a user specification that should have enabled 'nicholsonjf' to run all commands with sudo without having to enter a password (see the line that starts with 'nicholsonjf'):

# This file MUST be edited with the 'visudo' command as root.
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
# See the man page for details on how to write a sudoers file.
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL
nicholsonjf    ALL=NOPASSWD: ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

However, this did not work, and I was still prompted for my password every time I ran a command as 'nicholsonjf'. I was only able to start running sudo commands as 'nicholsonjf' once I removed 'nicholsonjf' from the sudo and admin groups.

Can anyone explain why this worked?

Is it because the user 'nicholsonjf' was inheriting sudo rights from the two group specifications of 'admin' and 'sudo' (seen below in the sudoers file), which were overriding the 'nicholsonjf' user specification because they were further down in the config file?

share|improve this question
note: ALL=NOPASSWD: ALL has to be ALL=(ALL) NOPASSWD: ALL or else it doesn't work... – André Verwijs Jun 12 '14 at 19:03
see also this answer :… – JB. Sep 7 '14 at 17:04
up vote 45 down vote accepted

Your added line was overridden. From man sudoers:

When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used (which is not necessarily the most specific match).

In your case nicholsonjf was a member of group sudo so for him this line applied:

%sudo   ALL=(ALL:ALL) ALL

If you want to override entries in /etc/sudoers just put the new entries after them.

share|improve this answer
For a complete solution I would like to see something about NOPASSWD in this answer... – Daniel Alder Dec 5 '14 at 15:08
I think, the solution should be: %sudo ALL=(ALL) NOPASSWD:ALL – Daniel Alder Dec 8 '14 at 9:20
@DanielAlder: The specification line from the question nicholsonjf ALL=NOPASSWD: ALL is correct. It was just at a wrong place as I explained in the answer. ------ The Runas specification — in your case (ALL) — is optional. If you omit the specification you can run the commands as root and you cannot use -u and -g options of sudo. – pabouk Dec 9 '14 at 8:12
This is a worse security risk as it gives multiple users passwordless access. If it's your personal PC then that's not significant - perhaps. I'd just move the personal line, to last. – Mark Williams Dec 9 '14 at 8:15
An addition, rather than correction, if using something debian/ubuntu based (may be generally applied, not seen it elsewhere) Your absolute best-practice bet is to add custom commands to a file in /etc/sudoers.d/ and leave sudoers itself to be managed by the package manager. – Aquarion Nov 10 '15 at 12:02

For a single user :


For a group :

%supergroup  ALL=(ALL) NOPASSWD:ALL
share|improve this answer
Before I read this answer I did %sudo ALL=NOPASSWD: ALL and it works. Am I the only one who finds Extended Backus-Naur Form really hard to understand? – Vince Jan 22 at 0:01

I posted a pretty good answer here, a method that uses groups to easily toggle which users on a linux system can have password-less sudo:


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.