On one particular machine I often need to run sudo commands every now and then. I am fine with entering password on sudo in most of the cases.

However there are three sudo commands I want to run without entering password:

  • sudo reboot
  • sudo shutdown -r now
  • sudo shutdown -P now

How can I exclude these commands from password protection to sudo?


2 Answers 2


Use the NOPASSWD directive

You can use the NOPASSWD directive in your /etc/sudoers file.

If your user is called user and your host is called host you could add these lines to /etc/sudoers:

user host = (root) NOPASSWD: /sbin/shutdown
user host = (root) NOPASSWD: /sbin/reboot

This will allow the user user to run the desired commands on host without entering a password. All other sudoed commands will still require a password.

The commands specified in the sudoers file must be fully qualified (i.e. using the absolute path to the command to run) as described in the sudoers man page. Providing a relative path is considered a syntax error.

If the command ends with a trailing / character and points to a directory, the user will be able to run any command in that directory (but not in any sub-directories therein). In the following example, the user user can run any command in the directory /home/someuser/bin/:

user host = (root) NOPASSWD: /home/someuser/bin/

Note: Always use the command visudo to edit the sudoers file to make sure you do not lock yourself out of the system – just in case you accidentally write something incorrect to the sudoers file. visudo will save your modified file to a temporary location and will only overwrite the real sudoers file if the modified file can be parsed without errors.

Using /etc/sudoers.d instead of modifying /etc/sudoers

As an alternative to editing the /etc/sudoers file, you could add the two lines to a new file in /etc/sudoers.d e.g. /etc/sudoers.d/shutdown. This is an elegant way of separating different changes to the sudo rights and also leaves the original sudoers file untouched for easier upgrades.

Note: Again, you should use the command visudo to edit the file to make sure you do not lock yourself out of the system:

sudo visudo -f /etc/sudoers.d/shutdown 

This also automatically ensures that the owner and permissions of the new file is set correctly.

If sudoers is messed up

If you did not use visudo to edit your files and then accidentally messed up /etc/sudoers or messed up a file in /etc/sudoers.d then you will be locked out of sudo.

The solution could be to fix the files using pkexec which is an alternative to sudo.

To fix /etc/sudoers:

pkexec visudo

To fix /etc/sudoers.d/shutdown:

pkexec visudo -f /etc/sudoers.d/shutdown

If the ownership and/or permissions are incorrect for any sudoers file, the file will be ignored by sudo so you might also find yourself locked out in this situation. Again, you can use pkexec to fix this.

The correct permissions should be like this:

$ ls -l /etc/sudoers.d/shutdown 
-r--r----- 1 root root 86 Jul 16 15:37 /etc/sudoers.d/shutdown

Use pkexec like this to fix ownership and permissions:

pkexec chown root:root /etc/sudoers.d/shutdown
pkexec chmod 0440 /etc/sudoers.d/shutdown
  • 2
    The two lines refer specifically to these two commands. If user is not in other ways given sudo rights no other commands can be sudoed by this user. Have a look at man sudo and man sudoers.
    – mgd
    Jul 5, 2012 at 15:27
  • 4
    @StanKurdziel I tried with this line on Mac OS X Yosemite and it worked fine: mgd ALL=(root) NOPASSWD: /var/root/test. I am user mgd and ALL means "from all hosts". /var/root/test is a simple "Hello World" shell script with permissions: -rwx------ 1 root wheel 27 12 Jun 09:54 /var/root/test. I made no other changes to the system.
    – mgd
    Jun 12, 2015 at 8:02
  • 4
    What is host in the sudoers file?
    – user106563
    Oct 20, 2016 at 14:02
  • 2
    It's not an answer, it's almost full guide about NOPASSWD directive. Thank you.
    – Eray
    Aug 14, 2017 at 20:10
  • 1
    @Michael please read the man page. It is all written there. To quote it: However, you may also specify command line arguments (including wildcards). Alternately, you can specify "" to indicate that the command may only be run without command line arguments.
    – mgd
    Aug 31, 2017 at 18:35

Sorry but there's so much confusion over this and some really complicated answers, that i feel i must weigh in here before someone misunderstands and does something crazy.

Using visudo!!


Add the following lines to the config:

ALL ALL=NOPASSWD: /sbin/reboot,/sbin/shutdown

This allows the commands, reboot and shutdown with any parameters to be executed from any user. The first "ALL" refers to the users, so it means ALL users. The second ALL refers to ALL hosts.

For a more verbose explanation see man sudoers as this provides further examples and these examples are several pages down but they are actually there if you dig deep enough.

Please stackexchange, just give simple, succinct answers.

  • 3
    There is one other answer. Comparing this answer with the other: the other answer explained how to set for one user on one host; the generalization to multiple users and multiple hosts is obvious. Your answer gives a magic incantation (which actually applies to all users or all hosts, but that is entirely inobvious). The other difference is that your answer gives two commands on a single line. I didn't know you could do that - it's mildly useful, but given the complexity of sudoers I doubt I will ever use it. Jan 13, 2020 at 10:21
  • You've got me. visudo only edits the sudoers file. Everything important and uncommented is in ALL.
    – jaromrax
    Feb 18, 2021 at 12:38
  • @Owl Please provide the exact steps.
    – Nav
    Apr 17 at 14:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.