Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I noticed that two groups are granted similar-looking permissions in /etc/sudoers:

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

My user account with "Administer the system" privileges is in the admin group, and there don't appear to be any users in the sudo group. What are these two groups for?

share|improve this question
add comment

4 Answers

up vote 25 down vote accepted

Ubuntu 12.04 LTS and later

Administrators are added to the sudo group, but the admin group is supported for backward compatibility. From the release notes:

Up until Ubuntu 11.10, administrator access using the sudo tool was granted via the admin Unix group. In Ubuntu 12.04, administrator access will be granted via the sudo group. This makes Ubuntu more consistent with the upstream implementation and Debian. For compatibility purposes, the admin group will continue to provide sudo/administrator access in 12.04.

It is not created when you do a fresh install, though it is still present if you upgraded from previous distributions. Either way, the admin group appears in the /etc/sudoers file.

See implementation details and the official documentation.

share|improve this answer
add comment

Members of the admin group may gain root privileges temporarily by entering their own password. Members of the sudo group always have root privileges.

share|improve this answer
    
Um ... no. (I would downvote, but I'm new here...) –  SamB Feb 21 '12 at 21:05
2  
@AthulIddya Only root runs everything with root privileges. The whole point of sudo is to enable a non-root user to perform actions with root privileges. So this answer is incorrect. It occurred to me that maybe you were thinking that the sudo group doesn't need to enter a password to use sudo, while the admin group does, but that is also not the case (if you look at the default /etc/sudoers file, there's no NOPASSWD in either entry). –  Eliah Kagan Apr 16 '12 at 12:20
add comment

No security difference.

Both have 100% unrestricted access to anything provided by the OS.

The difference in your /etc/sudoers is (ALL) vs (ALL:ALL). The first one means you can run commands as any user. The second - you can run command as any user and as any group.

The way shown in your /etc/sudoers both groups will need to enter their own password to execute commands as root.

Both can a root shell like this:

sudo su
share|improve this answer
add comment

Ubuntu 11.10 and earlier

By default the sudo group is not used in Ubuntu:

  • the user created during installation belongs to admin group, not sudo;
  • no guide or manual I ever read advices to use the sudo group;
  • no one feels the need to use the sudo group, because the admin group can do all one needs.

Conversely, on Debian the group enabled in /etc/sudoers is the sudo group, and there is no admin group. But the user created during installation is not put in that group, because Debian has the root account enabled. You should do it explicitly, if you want to.

Also, Fedora is similar to Debian, having root enabled and no default privileges for the user create during installation. But the administrative group configured in /etc/sudoers is the more traditional group wheel.

In conclusion, I think there is no use for sudo group in Ubuntu, simply it is a Debian heritage.

share|improve this answer
    
On my Ubuntu system, no users are member of sudo: grep '^sudo:' /etc/group (just installed). Not sure about Debian, I've just added my own name to the /etc/sudoers file. –  Lekensteyn May 17 '11 at 15:59
1  
@Lekensteyn: as I said, on Debian you should explicitly add a user to the sudo group to gain administrative privileges: su -c "gpasswd -a $USER sudo", no need to modify /etc/sudoers. Or you can stand with the Debian way of using directly the root account. –  enzotib May 17 '11 at 16:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.