Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to make it impossible for any root commands to be issued during a Live Boot session. I don't want anyone being able to sign in as root. Period!

So, is it possible to stop the sudo service? If so, would this accomplish what I'm trying to do?

I tried the three possible stop service commands below but chkconfig --list show sudo still working:


sudo stop sudo


sudo /etc/init.d/sudo stop


sudo service sudo stop
share|improve this question
Really? Why would you think sudo is a service? Just curious what lead you there. (Because sudo is a command.) No user can sudo successfully unless the same is in the admin group. – user8290 Jan 30 '12 at 1:36
This question makes me smile :)... – RolandiXor Jan 30 '12 at 2:05
... actually, a totally valid and interesting question :) A really good answer to this explains exactly what sudo does, how to disable it and how to close it down even more (e.g. try typing "sudo su" within a guest session - that behaviour should be exactly what the user wants) – Stefano Palazzo Jan 30 '12 at 3:49
chkconfig --list, it shows all services, lists the run levels, sudo is one of them. – bambuntu Jan 31 '12 at 6:21
@Ignatio Thanks! I know it's not important to you now, but thought it worth a mention that the chkconfig command is not an Ubuntu-native tool. Apparently, it is just dumbly picking up scripts in /etc/init.d directory. If you cat /etc/init.d/sudo you can see that only the "start" switch does anything at all. – user8290 Jan 31 '12 at 23:34
up vote 2 down vote accepted

You can't get rid of sudo the way you think, but you can explicitly define what users are allowed to do, all the way from disallowing sudo through to requiring passwords for particular commands. It is very powerful.

You do this through the use of sudoers


The /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands.

It does this through four kinds of aliases: User_Alias, Runas_Alias, Host_Alias and Cmnd_Alias which work as their names suggest.


share|improve this answer
Ok, so how do I disable all commands from sudo? Could I change global permissions restricting sudo altogether from everything? – bambuntu Jan 31 '12 at 6:34
This is probably the right answer but it's incomplete :( – roadmr Jan 31 '12 at 16:36

You have to restrict Physical access. If someone has physical access to your computer (hard drive) they have root access, regardless of OS.

This is why they keep servers in locked rooms =)

Second best is an encrypted installation. That will make it difficult or impossible for someone with physical access to access your data, assuming the computer is shut off and they do not install a modified kernel.

To further refine my answer, now that you have asked about setting up a kiosk ..

First, you need root access via some mechanism, sudo or su, take you pick, to perform system administration. Since completely disabling sudo , su, or all root access is unrealistic. With what you have posted, I would look at locking down your kiosk with apparmor (take a look at the apparmor profile for the gurest account as a template).

If you do not know how to use apparmor, use a distro that is built as a kiosk. Why re-creating the wheel?

Options here

1) Use Ubuntu with the guest account. The guest account is confined by apparmor:

2) There are other options

Fedora makes a kiosk spin, locked down with selinux

3) Other distors

share|improve this answer
My patrons need physical access. Ok, let me make things clearer. The terminal is a kiosk with a live remastered Ubuntu disk running. I do not want a password to open any root access period. What I am imagining here is it will be remastered Ubunutu distro running live that's in infinite non-root user loop. I want it to purposely run this way. Is there any way to pipe all root attempts to null or something? I want a complete root lockout and user locked in (no logout, no shutdown, only physical power down.) – bambuntu Jan 31 '12 at 6:32
See my updated answer. – bodhi.zazen Jan 31 '12 at 16:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.