So I was trying to grant user name shutdown as root permission. I created a shutdown group and add my username using:

groupadd shutdown
usermod -A shutdown annguyen

Afterward, I logged in a as root using su - then visudo. Commented out these lines:

Defaults targetpw

I will talk about what happens if I uncomment them.

I then add the line %shutdown ALL=(ALL) NOPASSWD:/sbin/shutdown

Ok, so here's the behavior.

When I call up xterm, then typed sudo /sbin/shutdown -h 17:00 it returns user annguyen is not in the sudoer file. This incident will be reported. I have checked again and again, I'm positive that I am in the shutdown group and the line allowing the group to use shutdown is added.

However, when I log into myself again using su annguyen and try sudo /sbin/shutdown ... again it works. However I am effectively logged in twice as my own username. I know because when I type exit it doesn't close xterm but return me to the parents shell, also logged in as me. So basically, the child shell logged in as annguyen can call sudo shutdown, but the parent shell, also logged in as annguyen, can't. Why is that?

Not sure if I miss anything. Ultimately, what I wanted is that if I invoke sudo /sbin/shutdown/ it will ask me for annguyen's password while everything else is for root.

Is this possible?



  • Nevermind, found out that I had to log out and back in before I can do it straight forward. Which is what happened when I used su annguyen. For the other part, I don't think that's possible, I will just keep adding privilages to myself while logging in to su - if I need real root. – VietnamElectric May 11 '12 at 20:34

As you discovered for the 1st part, you need to log out and in to apply the new group to your user.

For the second part: group shutdown is for users not allowed to sudo to root. If your user sudo to root, there is no advantage to be also in shutdown group (in relation to this command).

The sudo "command" increases the privileges of the active user and the "level of increase" is not based on the command that comes after but on the user. If your user is allowed to sudo to root, sudo will run the command as root, even if other users (in shutdown group and not sudoers) can run this command too as shutdown group and not root.

|improve this answer|||||
  • hummm not sure it is very clear... – laurent May 11 '12 at 20:57
  • Haha, a bit muddled but basically you meant I don't really need to do visudo if I myself have root pw, right? True, this is mostly messing around on my own laptop to see what I can do as a sysadmin. Not sure about the sudo privilage ladder thing, I will look into that later. I was working on iptables and trying to let my own user being able to adjust iptables instead of using root. – VietnamElectric May 11 '12 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.