CheatPress

sudo Run as another user

Version 1.9 · source

sudo, Postcard, light preview Light · Postcard 102 × 152 mm · PDF sudo, Postcard, dark preview Dark · Postcard 102 × 152 mm · PDF sudo, Postcard, ink saver preview Ink saver · Postcard 102 × 152 mm · PDF
sudo, A5, light preview Light · A5 148 × 210 mm · PDF sudo, A5, dark preview Dark · A5 148 × 210 mm · PDF sudo, A5, ink saver preview Ink saver · A5 148 × 210 mm · PDF
sudo, A4, light preview Light · A4 210 × 297 mm · PDF sudo, A4, dark preview Dark · A4 210 × 297 mm · PDF sudo, A4, ink saver preview Ink saver · A4 210 × 297 mm · PDF
sudo, A4 landscape, light preview Light · A4 landscape 297 × 210 mm · PDF sudo, A4 landscape, dark preview Dark · A4 landscape 297 × 210 mm · PDF sudo, A4 landscape, ink saver preview Ink saver · A4 landscape 297 × 210 mm · PDF
sudo, A3, light preview Light · A3 297 × 420 mm · PDF sudo, A3, dark preview Dark · A3 297 × 420 mm · PDF sudo, A3, ink saver preview Ink saver · A3 297 × 420 mm · PDF
sudo, A3 landscape, light preview Light · A3 landscape 420 × 297 mm · PDF sudo, A3 landscape, dark preview Dark · A3 landscape 420 × 297 mm · PDF sudo, A3 landscape, ink saver preview Ink saver · A3 landscape 420 × 297 mm · PDF
sudo, Letter, light preview Light · Letter 8.5 × 11 in · PDF sudo, Letter, dark preview Dark · Letter 8.5 × 11 in · PDF sudo, Letter, ink saver preview Ink saver · Letter 8.5 × 11 in · PDF
sudo, Tabloid, light preview Light · Tabloid 11 × 17 in · PDF sudo, Tabloid, dark preview Dark · Tabloid 11 × 17 in · PDF sudo, Tabloid, ink saver preview Ink saver · Tabloid 11 × 17 in · PDF

Start here

sudo <command>
Run as root
sudo -u <user> <command>
Run as another user
sudo -i
Root login shell
sudo -l
What may I run?
sudo -e <file>
Edit a root-owned file
sudo -v
Refresh the password cache
sudo -k
Forget cached password
sudo visudo
Edit the rules safely

Concepts

  1. You run sudo command + options
  2. /etc/sudoers who, where, as whom, what
  3. Password cached for a few minutes
  4. Command as target user

Running commands

sudo <command>
Run a command as root
sudo -u <user> <command>
Run as another user
sudo -g <group> <command>
Run with another primary group
sudo -u <user> -g <group> <command>
Set user and group
sudo -u '#<uid>' <command>
Target a user by numeric UID
sudo -n <command>
Fail instead of asking for a password
sudo -b <command>
Run in the background
sudo -T <time> <command>
Kill the command after a timeout
Needs a sudoers rule that allows user-set timeouts.
sudo -R <dir> <command>
Run with another root directory
sudo -- <command> -x
Stop sudo parsing options
sudo !!
Repeat the last command with sudo
Bash and zsh history expansion, not sudo itself.

Shells

sudo -i
Root login shell with root's environment
sudo -s
Root shell keeping your environment
sudo -iu <user>
Login shell as another user
sudo -i <command>
Run a command through the login shell
sudo -H <command>
Set HOME to the target user's home

Privileges and password cache

sudo -l
List what you may run here
sudo -ll
List in the long format
sudo -l <command>
Check if a command is allowed
sudo -l -U <user>
List another user's privileges
sudo -v
Refresh the cache without running anything
sudo -k
Invalidate the cache for this session
sudo -K
Remove all cached credentials
sudo -k <command>
Run a command and force a password prompt
sudo -V
Show sudo and plugin versions
sudo -h
Short help
sudo -S
Read the password from stdin
sudo -A
Ask for the password via a helper program
sudo -p '<prompt>'
Custom password prompt

Environment

sudo -E <command>
Keep your environment variables
The policy may refuse; PATH and similar are often reset anyway.
sudo <VAR>=<value> <command>
Set a variable for one command
Only variables the policy allows.
sudo env <VAR>=<value> <command>
Set a variable via env
sudo -P <command>
Keep your supplementary groups
sudo env | grep -i path
See the environment sudo passes on

Editing files

sudo -e <file>
Edit a copy and write it back as root
sudoedit <file>
Same as sudo -e
sudoedit <file1> <file2>
Edit several files in one session
SUDO_EDITOR=<editor> sudoedit <file>
Pick the editor for sudoedit
Order: SUDO_EDITOR, VISUAL, EDITOR.

Redirection and pipes

echo '<text>' | sudo tee <file>
Write a root-owned file
echo '<text>' | sudo tee -a <file>
Append to a root-owned file
echo '<text>' | sudo tee <file> >/dev/null
Write without echoing to the screen
sudo sh -c '<command> > <file>'
Redirect inside a root shell
sudo bash -c '<command1> && <command2>'
Run a compound command as root
<command> | sudo -u <user> <command>
Pipe into a command run as another user
sudo cat <file> | <command>
Read a root-only file into a pipe

sudoers rules

sudo visudo
Edit /etc/sudoers with a syntax check
sudo visudo -f /etc/sudoers.d/<name>
Edit a drop-in file
sudo visudo -c
Check the syntax only
sudo visudo -cf <file>
Check one file
Rule: who where = (as whom) what
Part Example Meaning
user or %group alice, %admin who may run it
host ALL on which machine
(runas) (root), (ALL) as which user
tags: commands NOPASSWD: /usr/bin/apt what, and options
alice ALL=(ALL:ALL) ALL
Full rights for a user
%wheel ALL=(ALL) ALL
Full rights for a group
alice ALL=(root) NOPASSWD: /usr/bin/systemctl restart <svc>
One command without a password
alice ALL=(root) /usr/bin/apt update, !/usr/bin/apt remove *
Allow some, deny others
Cmnd_Alias <NAME> = <cmd1>, <cmd2>
Name a group of commands
Defaults timestamp_timeout=<minutes>
Change the password cache time
Defaults:<user> !authenticate
Never ask this user for a password
Defaults env_keep += "<VAR>"
Always keep a variable
@includedir /etc/sudoers.d
Include drop-in rule files

Recipes

Edit a system file as yourself
sudo -e /etc/hosts# or choose the editorSUDO_EDITOR=vim sudoedit /etc/fstab
Append a line to a root-only file
echo 'vm.swappiness=10' | sudo tee -a /etc/sysctl.d/99-local.confsudo sysctl --system
Let a user restart one service
sudo visudo -f /etc/sudoers.d/deploy# add:deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myappsudo visudo -c
Audit what a user may do
sudo -l -U alicesudo -llsudo -l /usr/bin/apt