sudo

Sudo is a program for Unix-like operating systems that lets a permitted user execute a command with the privileges of another user, typically the superuser (root). It enables privilege escalation without logging in as root, reducing the need to share the root password and providing an auditable trail of privileged actions.

Access is controlled by the sudoers policy, read at run time. When a user runs sudo, the program authenticates the user (usually with their own password), checks the policy, and, if allowed, executes the command with elevated privileges. The -u option can specify a different target user, and credentials can be cached for a timeout to avoid repeated prompts within that window.

Configuration is in the sudoers file, typically /etc/sudoers, edited with visudo to catch syntax errors. The file uses aliases for users, hosts, and commands, and contains rules that grant privileges. Examples: "jane ALL=(ALL) ALL" grants jane permission to run any command on any host as any user, subject to authentication; "admin ALL=(ALL) NOPASSWD: /bin/systemctl" allows running systemctl without a password.

Security considerations: Sudo centralizes privileged access, so careful policy design is essential. Misconfigurations can widen access. Best practices include the principle of least privilege, limiting commands per user, requiring passwords by default, and enabling logging. Logs usually go to syslog or the system journal.

Usage and alternatives: Sudo is standard on most Linux distributions and macOS, and is often preferred to logging in as root because it provides an auditable trail. Alternatives include doas, and PolicyKit-based workflows such as pkexec.