Only administrators can perform administrative tasks through the utility sudo. To increase the privileges of a user account, you must yourself first be an administrator. To assign the Administrator role to another user account:

• In Ubuntu and Xubuntu: using the user management module of the system control panel to change its privileges;
• In Kubuntu: use the account management module for users of the KDE administration panel to change its privileges;

• In console mode: Open a terminal and run the following command:

  sudo adduser <username> sudo

  which <username> must be replaced by the username of the user account (without the <tags>) to which additional privileges must be granted.

Note that changes privileges are not applied upon registration. They are applied only when all current sessions are closed to that rate. At the next logon for this account, the new privileges are taken into account.

Bring to the section “Add or remove privileges to a user account or a user group” to configure more precisely the privileges granted by the utilitysudo.

sudocan be set finely to allow or deny the execution of privileged tasks. More than simply allow execution of all administrative tasks to a group of users by password authentication sudocan be configured to allow a particular user or a particular user group to perform one or more tasks specific, with or without password entry. Other parameters such as the waiting period before a re-authentication is needed, where is logged to the event log and the level of courtesy sudo, are also customizable.

• Advanced configuration of / etc / sudoers

The benefits of employment sudo, as opposed to the direct use of a single root account ( root), many are for use in a domestic environment or SME / SMI:

• The Ubuntu installer has to ask fewer questions. This is particularly important for the new arrival, who may not be aware of the usefulness of the root account and its hazardous potential;
• Administrators do not have to remember an extra password, they can easily forget, or compromise the security of the account rootby bad habits;
• This prevents the behavior of “I can do everything on my machine” before performing an administrative action Ubuntu asks for your password, which should reflect the directors of the consequences of their action;
• sudokeeps track of every command run. If a problem occurs, you can always check the newspaper to find the command that caused the problem;
• All hackers trying to break through brute force your system know that there is an account called rootand try to hack it first. They do not know the identifiers of other users of your computer;
• This allows fast transfer of administrative rights for both the long and for the short term, by simply adding or removing a user from the administrative group. All without compromising the security of your computing environment by sharing a single password for the account root ;
• sudo can be configured with a more refined policy.

The basic security model is the same, and both models share the same weakness. Any user using su rootor sudoto perform administrative tasks must be considered as a privileged user. If the user’s account is compromised by an attacker, the latter can also obtain elevated privileges and compromise the operating system. Users with administrative rights must be protected with the same care as the root account.

On a more esoteric notes, note that sudoencourages change in working habits, which may cause a positive impact on the security of the operating system. sudois usually used to execute a single command, then that su rootis often used to run a terminal rootand run multiple commands. The approach sudoreduces the possibility that a terminal rootis left open indefinitely on the job and encourages the user to minimize its use of administrative privileges.

All actions performed through the utility sudo– it to pass with success or failure – are logged. They are recorded in the log file / var / log / auth.log .

Use sudoto execute a single command does not cause a real inconvenience, but it can be unpleasant to use it to run a long process requiring several interventions in super-user mode ( root). Opening a terminal mode rootavoids having to call sudoat each stage of this procedure, without having to enable access to the user account root. The disadvantage of this method is no record of the actions taken is not recorded in the logsudo(if the opening of the terminal rootitself). It is not advisable to open a terminal root.

To use a terminal root:

1. Open a terminal window ;

2. Enter the following command:

   @ Computer user: ~ $ sudo -i

3. Enter your password in the password input prompt;
4. Run your set of administrative commands;

5. Log off root:

   root @ computer: ~ # exit

   or Ctrl+D

sudoposes a priori problems for redirecting flow in a console. For example, the following redirection will not work:

@ Computer user: ~ $ sudo echo 2> / proc / acpi / thermal_zone / ATF0 / polling_frequency

The reason for this failure is that sudoonly executes the first task ( echo 2) with the borrowed identity; redirection, it is done in user mode only.

The solution to overcome this limitation is to call a new shell and make it run your redirect flows. For example :

@ Computer user: ~ $ sudo sh -c 'echo 2> / proc / acpi / thermal_zone / ATF0 / polling_frequency'

In this way, it is the interpreter shand passed as an argument command is executed with the borrowed identity.

Some programs or services require super-user accounts. This is usually the case with database systems (such as MySQL). Note that this root account is independent of the operating system: it is unique to the particular program or service. If such a program or service requires super user account, you must set up the account with the tools it provides. In this connection, bring to the help documents for each of your applications concerned.