I'm trying to script the creation of a user with sudo access for my ec2 instances.

I'm having problems setting up sudo access. I'm running the following as root...

adduser --disabled-password --gecos "" testuser
usermod -a -G admin,sudo testuser

I then copy the authorized_keys from s3.

The ssh works fine at this point.

However if I try to sudo, I'm prompted for a password.

My sudoers file includes the following...

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Apart from logging out and logging back in, is there anything I need to do to actually make my changes take effect?

I didn't change the sudoers file, this was the default setup.

Also there's another system created user ubuntu, which can sudo successfully. However there is no explicit mention of this user in the sudoers file, so it must be doing it through group membership.

update: I tried adding every other group that "ubuntu" belongs to testuser, but I'm still being prompted for the password.

Is there any way I can figure out how "ubuntu" gets passwordless sudo access?


2 Answers 2


You will always be prompted for a password unless you have the NOPASSWD option set in the sudoers file for any given entry (ignoring the grace period the password is remembered and hence not prompted, default 15 minutes).

For example, to make all members of the sudo group to have passwordless sudo implementation:


This indicates any member of the sudo group can run any command starting with sudo without prompting for password.

Similarly for user foobar to run the command reboot:

foobar ALL=(ALL:ALL) NOPASSWD: /sbin/reboot

Note that, it is not a good idea to have passwordless sudo access for all commands unless you have a very good reason, you should consider restricting the commands to a necessary minimum.

The sudo rules can also be defined in files under the /etc/sudoers.d/ directory, default /etc/sudoers file contains:

includedir /etc/sudoers.d

at the end, this makes any file that does not contain . or ends in ~ to be read for sudo rules. Presumably the definitions for user ubuntu defined in any of the files under the /etc/sudoes.d/ directory.

  • This is what I thought, but somehow the "ubuntu" user is able to do it. I'm not prompted for a password, and there is no specific entry for this user in sudoers. Aug 21, 2016 at 2:41
  • @user1751825 Check id ubuntu
    – heemayl
    Aug 21, 2016 at 2:43
  • I haven't modified the sudoers file at all. If at all possible I'd like to keep everything as standard as possible. Aug 21, 2016 at 2:48
  • 2
    @user1751825 Check also the files in /etc/sudoers.d/ directory, its probably defined in any of those files.
    – heemayl
    Aug 21, 2016 at 2:55
  • That was it. I don't know how I didn't think of that. There is a file in /etc/init.d/ that does it. Aug 21, 2016 at 3:37

I had the same issue, on an AWS EC2 instance. Turns out that cloud-init adds a file in /etc/sudoers.d 90-cloud-init-users with these contents:

# Created by cloud-init v. 19.2-36-g059d049c-0ubuntu2~18.04.1 on Wed, 05 Jan 2022 09:44:40 +0000

# User rules for ubuntu

Adding the same line for my user solved the issue.

Since you mentioned S3 i guess this is your issue, combined with the behaviour of the sudoers config file: " When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used (which is not necessarily the most specific match).", see man sudo.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .