Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I edit an invalid visudo file?

Here is what happens:

$ sudo visudo

>>> /etc/sudoers: syntax error near line 28 <<<
sudo: parse error in /etc/sudoers near line 28
sudo: no valid sudoers sources found, quitting
share|improve this question
great question considering this page creates that error – user128334 Sep 21 '13 at 18:14

12 Answers 12

up vote 219 down vote accepted

On a modern Ubuntu system (and many other GNU/Linux distributions), fixing a corrupted sudoers file is actually quite easy, and doesn't require rebooting, using a live CD, or physical access to the machine.

To do this via SSH, log in to the machine and run the command pkexec visudo. If you have physical access to the machine, SSH is unnecessary; just open a Terminal window and run that pkexec command.

Assuming you (or some other user) are authorized to run programs as root with PolicyKit, you can enter your password, and then it will run visudo as root, and you can fix your /etc/sudoers.

If you need to edit one of the configuration files in /etc/sudoers.d (which in uncommon in this situation, but possible), use pkexec visudo -f /etc/sudoers.d/filename.

If you have a related situation where you have to perform additional system administration commands as root to fix the problem (also uncommon in this circumstance, but common in others), you can start an interactive root shell with pkexec bash. Generally speaking, any non-graphical command you'd run with sudo can be run with pkexec instead.

(If there is more than one user account on the system authorized to run programs as root with PolicyKit, then for any of those actions, you'll be asked to select which one you want to use, before being asked for your password.)

If that doesn't work--for example, if there are no users authorized to run programs as root via PolicyKit--then boot from an Ubuntu live CD (like the CD you probably used to install Ubuntu) and mount the filesystem for the installed system. You can do this by running sudo parted -l to view your partitions--there is probably just one ext4 partition, and that's the root filesystem.

Suppose the installed Ubuntu system's root filesystem is on /dev/sda1. Then you could mount it with sudo mount /dev/sda1 /mnt. Then you can edit the installed system's sudoers file with sudo nano -w /mnt/etc/sudoers. Or, even better, you can edit it with

sudo visudo -f /mnt/etc/sudoers

(which will prevent you from saving a sudoers file with incorrect syntax).

share|improve this answer
pkexec /usr/sbin/visudo worked on debian 7 – marinara Mar 5 '14 at 1:33
Couldn't they also just boot into recovery mode? – Seth Oct 11 '14 at 16:43
HOLY COW! Thanks a LOT! Saved my bacon. Added a file as suggested into etc/sudoers.d/ directory USING A REGULAR TEXT EDITOR (D-O-N-T__D-O__T-H-A-T!!!). Lost all ability to do elevated privileges, INCLUDING, editing the offending file. This helped edit the file. Weird though, I had to edit /etc/sudoers first, then it found the errors in the other file and opened that for me. EVEN WEIRDER, the directive in /etc/sudoers file 'inlcudedir /etc/sudoers.d' was commented out, and it still includes it. – Dennis Apr 5 '15 at 3:15
@Dennis Somewhat confusingly, #include directives in sudoers files are treated specially; the leading # does not cause the rest of the line to be interpreted as a comment, in that case. As man sudoers says: "The pound sign (‘#’) is used to indicate a comment (unless it is part of a #include directive or unless..." See also visudo: #includedir sudoers.d (archived from – Eliah Kagan Apr 5 '15 at 3:49
@EliahKagan what if I don't even have pkexec installed? – Lucas Apr 16 '15 at 19:21

Always use visudo to edit your sudoers file, never edit it directly yourself. It will prevent you saving it to disk unless it validates.

share|improve this answer
hindsight is 20/20 – code_monk Jan 9 '15 at 1:57
It won't prevent disaster. It's easy enough to validly deny yourself. – Joshua Oct 5 '15 at 22:02
Can visudo be used by scritps? If so, how? – Lukas Jul 7 at 15:01

Type in:

pkexec visudo

Then change last line

#includedir /etc/sudoers


#includedir /etc/sudoers.d

It should solve your problem.

share|improve this answer
I've noticed that removing the leading # from #includedir causes syntax errors, the # is part of the directive, at least on Ubuntu 12.10. – SAFX Apr 5 '13 at 2:46
Thank you!!!!!!!!!!!!!! – zires Oct 10 '15 at 6:11

There is nothing wrong #include sudoer.d removing #include sudoer.d won't make any difference.

But please make sure you don't have any syntax errors. I had same issue but and spent hours to fix and just figured out they are syntax errors. Refer to manual and make them right.

For example Say your username is : dolly I used following which is wrong


correct syntax is

dolly ALL = (ALL) ALL //give permission to everything, not good


dolly ALL=(ALL) NOPASSWD:/usr/bin/thurderbird //good, give specific permission

hope this helps

share|improve this answer
A better approach than making sure you don't have syntax errors is to always use visudo when editing these files, which makes sure you don't have syntax errors for you, before it modifies file. visudo is not just for editing /etc/sudoers--it will also create and edit files in /etc/sudoers.d. It will also work with whatever text editor you want. See the manpage for details. – Eliah Kagan Jul 3 '12 at 0:12
As for giving specific permission, please note that this is only useful for very simple commands/apps, because any sufficiently complex app (including thunderbird, which should never be run as root anyway) will effectively give the user full system access when run as root. Even seemingly simple functionality opens the door to full root access. For example, a user who can run a program that can save a file to an arbitrary location as root can gain full root access (they can install their own /etc/sudoers, or if syntax limitations prevent that, they can install their own /etc/crontab). – Eliah Kagan Jul 3 '12 at 0:16

if anyone else like me didn't have pkexec installed, or was not able to run vi, visudo, nano or any other editor to change sudoers file you can be sure with this process.. I was saved with this:

  • reboot
  • hold shift key while booting to have option for recovery mode (enter it)
  • enter command line as root (second last option at my grub menu)
  • remount boot device for rw, and apply exec right for user, and edit file
    • mount -n -o remount,rw /
    • chmod u+x /etc/sudoers
    • nano /etc/sudoers

fix that mistake and be happy :)

cheers, krex

share|improve this answer
While pkexec solution suggested by @eliah-kagan seems to be easier, this one is more universal. On my machine it turned out that there is no pkexec installed and of course I could not install it because sudo apt-get install pkexec somehow did not work. – running.t Oct 15 '15 at 14:06

run recovery mode then type this

chown -R root:root /etc/sudoers.d
chmod u=rwx,g=rx,o=rx /etc/sudoers.d/
chmod u=r,g=r,o= /etc/sudoers.d/*

only the group and user root should have read privelege

share|improve this answer

If u messed up your sudoers file.You'll need to:

  • Reboot into recovery mode (hit escape during boot, choose the recovery mode option on the grub screen)
  • Choose the 'Enable networking' option (if you don't your filesystem will be mounted as read-only. who knew)
  • Chosee the 'Drop to root shell' option
  • run visudo, fix your file
  • Reboot with normal grub option

source :-

share|improve this answer

You can edit your boot entry while in grub as well.

Simply reboot your pc, and wait for grub to show. Then press "e" on the "Ubuntu" entry to edit it.

Look for a line with "linux = " or "kernel = " and simply add an "single" to the end of that line.

Then press F10 to boot this temporarily modified boot entry. This will give you a shell (without GUI) with root rights and you can edit the sudoers file with like nano /etc/sudoers back to its previous state.

Then reboot and its done.

share|improve this answer

I found the bug. It is in the last two lines of the default /etc/sudoers file. Remove the following entries from the end of the /etc/sudoers file with visudo.

#includedir /etc/sudoers.d
share|improve this answer
That seems like a related, but different situation from this one. In this situation, the problem isn't that there are bad files (or wrong permissions) in /etc/sudoers.d, but that /etc/sudoers was itself corrupt. – Eliah Kagan May 29 '12 at 6:32

You can also login as root on a tty console with Ctrl+Fn (Fn from 1 to 6) and run visudo.

share|improve this answer
pkexec visudo

then revert your mistakes

share|improve this answer
not necessary to use pkexec – Braiam Jan 1 '14 at 12:01
@Braiam visudo has to be run as root. If sudo doesn't work, pkexec sometimes does. This is covered by my earlier answer... but it is a correct answer, visudo by itself (when not run as root) will not work, and there may be value in correct, brief answers even when their recommendations overlap considerably with other answers. Of course, if one goes into recovery mode, that's a root shell and then neither sudo nor visudo is necessary for commands like pkexec. Maybe that's what you mean... – Eliah Kagan Mar 29 '14 at 5:30

check permissions of root system /. it must be owned by root und use 755, than find command of sudo will find the config.

share|improve this answer
What does "than find command of sudo will find the config" mean? – Eliah Kagan Mar 29 '14 at 17:45

protected by Braiam Mar 7 '14 at 23:50

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.