Birmingham mumbai

Configuring administrator access 
with sudo
By now, we've already used 
sudo
 quite a few times in this book. At this point, you 
should already be aware of the fact that 
sudo
 allows you to execute commands 
as if you were logged in as another user, with 
root
 being the default. However, 
we haven't had any formal discussion about it yet, nor have we discussed how to 
actually modify which of your user accounts are able to utilize 
sudo
.
On all Linux systems, you should protect your 
root
 account with a strong password 
and limit it to be used by as few people as possible. On Ubuntu, the 
root
 account is 
locked anyway, so unless you unlocked it by setting a password, it cannot be used 
to log in to the system. Using 
sudo
 is an alternative to logging in as 
root
 to execute 
commands directly, so you can give your administrators access to perform tasks that 
require 
root
 privileges with 
sudo
 without actually giving them your 
root
 password 
or unlocking the 
root
 account. In fact, 
sudo
 allows you to be a bit more granular. 
Using 
root
 directly is basically all or nothing—if someone knows the 
root
 password 
and the 
root
 account is enabled, that person is not limited and can do whatever they 
want. With 
sudo
, that can also be true, but you can actually restrict some users to 
use only particular commands and therefore limit the scope of what they are able to 
do on the system. For example, you could give an admin access to install software 
updates but not allow them to reboot the server.

---

Managing Users and Permissions