This is a fairly complex question related to the Sudoers file and the sudo command in general.

NOTE: I have made these changes on a dedicated machine running Ubuntu Desktop 13.04, that I use purely for learning purposes. I understand it's a huge security risk to enable NOPASSWD sudo.


Initially, my only change to the sudoers file (/etc/sudoers) was one line, a user specification that should have enabled 'nicholsonjf' to run all commands with sudo without having to enter a password (see the line that starts with 'nicholsonjf'):

# This file MUST be edited with the 'visudo' command as root.
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
# See the man page for details on how to write a sudoers file.
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL
nicholsonjf    ALL=NOPASSWD: ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

However, this did not work, and I was still prompted for my password every time I ran a command as 'nicholsonjf'. I was only able to start running sudo commands as 'nicholsonjf' once I removed 'nicholsonjf' from the sudo and admin groups.

Can anyone explain why this worked?

Is it because the user 'nicholsonjf' was inheriting sudo rights from the two group specifications of 'admin' and 'sudo' (seen below in the sudoers file), which were overriding the 'nicholsonjf' user specification because they were further down in the config file?


The line you added was overridden. From man sudoers:

When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used (which is not necessarily the most specific match).

In your case nicholsonjf was a member of the group sudo so for him this line applied:

%sudo   ALL=(ALL:ALL) ALL

If you want to override entries in /etc/sudoers just put the new entries after them.

The new entry should look like

myuser ALL=(ALL) NOPASSWD: ALL for a single user, or

%sudo ALL=(ALL) NOPASSWD: ALL for a group.

| improve this answer | |
  • 8
    For a complete solution I would like to see something about NOPASSWD in this answer... – Daniel Alder Dec 5 '14 at 15:08
  • 23
    I think, the solution should be: %sudo ALL=(ALL) NOPASSWD:ALL – Daniel Alder Dec 8 '14 at 9:20
  • 5
    @DanielAlder: The specification line from the question nicholsonjf ALL=NOPASSWD: ALL is correct. It was just at a wrong place as I explained in the answer. ------ The Runas specification — in your case (ALL) — is optional. If you omit the specification you can run the commands as root and you cannot use -u and -g options of sudo. – pabouk Dec 9 '14 at 8:12
  • This is a worse security risk as it gives multiple users passwordless access. If it's your personal PC then that's not significant - perhaps. I'd just move the personal line, to last. – Mark Williams Dec 9 '14 at 8:15
  • 7
    An addition, rather than correction, if using something debian/ubuntu based (may be generally applied, not seen it elsewhere) Your absolute best-practice bet is to add custom commands to a file in /etc/sudoers.d/ and leave sudoers itself to be managed by the package manager. – Aquarion Nov 10 '15 at 12:02

For a single user, add this line at the end of your sudoers file using the sudo visudo command:


For a group

%supergroup  ALL=(ALL) NOPASSWD:ALL
| improve this answer | |
  • 8
    Before I read this answer I did %sudo ALL=NOPASSWD: ALL and it works. Am I the only one who finds Extended Backus-Naur Form really hard to understand? – Vince Jan 22 '16 at 0:01
  • 4
    @Vince When used your command I can't sudo without password as user without sudo privileges. E.g. sudo -u root -i works, but sudo -u git -i doesn't. – NeverEndingQueue Dec 4 '16 at 10:28
  • This is a considerably more helpful answer than the accepted, which while it does answer the OP's question, is probably not what most people reach this page via Google looking for. – Mahmoud Al-Qudsi Feb 21 '18 at 1:26
  • 1
    putting the space between NOPASSWD: and ALL hosed my installation. It should be superuser ALL=(ALL) NOPASSWD:ALL – Marc Feb 3 at 13:31

To never prompt the current user for a password when that user uses sudo run this command:

echo "$USER ALL=(ALL:ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/dont-prompt-$USER-for-password

this will create a file called /etc/sudoers.d/dont-prompt-<YOUR USERNAME>-for-sudo-password and will mean that the user that you ran that command as will not be prompted for their password when executing the sudo command. You'll still be prompted for the password in other contexts, such as installing stuff from the Ubuntu Software graphical app.

The advantages of doing it this way over adding the line in the echo command to /etc/sudoers using sudo visudo (as suggested by the other answers) are

  1. /etc/sudoers is sometimes modified by system updates, whereas files in /etc/sudoers.d aren't
  2. the sudo visudo method is prone to error (as evidenced by this very question), whereas copy/pasting a command is harder to mess up

According to sudo cat /etc/sudoers.d/README this feature (of putting extra sudoer files in /etc/sudoers.d) has been enabled by default since Debian 1.7.2p1-1, which came out in the late 1990's (Ubuntu is based on Debian).

| improve this answer | |
  • I like the shortcut working for the current user – cljk Sep 25 at 6:56

As Vince has mentioned in a comment, you can use this line:


(This is different from the lines shown in those answers, and it solved the problem for me.)

| improve this answer | |
  • @Eliah this is not that different from the other answers. All it does is replace the placeholder supergroup in Fedir's answer with sudo. What next, another user for the group wheel? Or any other group the user happens to be using? – muru Oct 4 '17 at 11:19
  • 1
    @muru "All it does is replace the placeholder supergroup in Fedir's answer with sudo." What? Replacing supergroup with sudo in the line %supergroup ALL=(ALL) NOPASSWD:ALL yields %sudo ALL=(ALL) NOPASSWD:ALL, not %sudo ALL=NOPASSWD: ALL. – Eliah Kagan Oct 4 '17 at 11:21
  • Which is arguably worse, since now NOPASSWD is only for root as the target user. So, it doesn't even answer the question correctly! – muru Oct 4 '17 at 11:26
  • @muru What is is not even arguably, however, is a substitution of supergroup with sudo. This is its own answer, not a thanks post or a copy of another answer. But yes, I agree: unless they intend that, this will not be as good for most users as the methods in the other answers. (But, especially considering the question says "all commands," not "all target users," I don't think this is in effect not even attempting to answer the question that was asked.) – Eliah Kagan Oct 4 '17 at 11:34
  • 1
    This worked for me and I wanted to share with other users :) (remove my comment if desired). – E. Fortes Oct 5 '17 at 13:44

As I was researching this, I realized that there's a line in the /etc/sudoers file that is not a comment, but a directive that makes any file or folder under the directory /etc/sudoers/* override the contents of /etc/sudoers.

This is a sneaky little directive, as it appears to be a commented line upon first glance. It looks like this:

#includedir /etc/sudoers.d

This is how I've implemented the non-root, passwordless user in an ephemeral Docker Image for use in a CICD pipeline with the base image of ubuntu:18.04:

  useradd -U foo -m -s /bin/bash -p foo -G sudo && passwd -d foo && passwd -d root && \
  sed -i /etc/sudoers -re 's/^%sudo.*/%sudo ALL=(ALL:ALL) NOPASSWD: ALL/g' && \
  sed -i /etc/sudoers -re 's/^root.*/root ALL=(ALL:ALL) NOPASSWD: ALL/g' && \
  sed -i /etc/sudoers -re 's/^#includedir.*/## Removed the #include directive! ##"/g' && \
  echo "Customized the sudoers file for passwordless access!" && \
  echo "foo ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
  echo "root ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
  echo "foo user:";  su foo -c 'whoami && id' && \
  echo "root user:"; su root -c 'whoami && id'

What happens with the above code:

  • The user and group foo is created.
  • The user foo is added to the both the foo and sudo group.
  • The home directory is set to /home/foo.
  • The shell is set to /bin/bash.
  • The sed command does inline updates to the /etc/sudoers file to allow foo and root users passwordless access to the sudo group.
  • The sed command disables the #includedir directive that would allow any files in subdirectories to override these inline updates.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.