Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Background: I have a development machine with LAMP setup. Several developers would access the machine from time to time. Every time they make some change in a configuration file they will need to restart the apache server using sudo service apache restart or sudo /etc/init.d/apache2 restart

The Question:

What I want now is that every developer who accesses the machine does not have a sudo access to everything. Rather, he/she should only be able to run the service command using sudo and nothing else. Is it possible to do that?

share|improve this question
up vote 23 down vote accepted


Make a new group, web (call it what you wish)

sudo addgroup web

Add your developer(s) to the web group (use their login name).

sudo usermod -a -G web your_developer(s)

Then run sudo visudo

Add in a line

%web ALL=(ALL) /usr/bin/service apache2 *

The developers can then run

sudo service

using their log in password

Do NOT add your admin user to the web group

see man sudoers for additional information

share|improve this answer
thanks u saved my day – Ankit Dec 27 '11 at 6:55
@Ankit: that way the users of web group can start/stop any service, and this is not what you want, I think. The solution should be to put the exact command (also with parameters) in /etc/sudoers. – enzotib Dec 27 '11 at 10:23
@enzotib can i do that to i mean so the new command would be /usr/bin/service apache2 is it? – Ankit Dec 27 '11 at 12:08
@Ankit: /usr/bin/service apache2 * – enzotib Dec 27 '11 at 13:10
This should also probably be /usr/sbin/service – Erfan May 26 at 13:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.