“user is not in the sudoers file” and “sudo: command not found”: what they mean and how to fix them
<code>sudo</code> only lets you run commands as root if a rule in <code>/etc/sudoers</code> says you may. On most systems that rule covers a group (<code>sudo</code> on Debian and Ubuntu, <code>wheel</code> on Fedora, RHEL and Arch), so the error usually just means your account isn’t in that group yet.
The messages you might see
| Message | What it means |
|---|---|
sam is not in the sudoers file. This incident will be reported. | sudo is installed, but no rule lets you use it (newer versions drop the second sentence) |
Sorry, user sam may not run sudo on myhost. | Same idea: you have no sudo rights on this machine |
sudo: command not found or bash: sudo: command not found | The sudo program itself isn’t installed (common in containers and minimal installs) |
sudo: a terminal is required to read the password | A script or CI job asked for a password with no keyboard to type it |
sudo: unable to resolve host myhost | Only a warning: your hostname is missing from /etc/hosts |
Check where you stand
id # your user, and every group you are in
groups # just the group names
sudo -l # what sudo allows you (asks for your password)If sudo or wheel is missing from groups, that’s the whole problem.
Add yourself to the right group
You need root to do this, which is the catch. Pick whichever way in you have:
| Your situation | How to get a root shell |
|---|---|
| You know the root password | su -, then run the usermod line below |
| Another account on the machine is an admin | Ask them to run it, or log in as them |
| A cloud server | Log in as the image’s default user (often ubuntu, ec2-user, admin or root), or use the provider’s web console |
| Ubuntu with no root password (root is locked by default) | Reboot, hold Shift or press Esc for the GRUB menu, choose Advanced options, then recovery mode and root. Run mount -o remount,rw / first so you can make changes |
| WSL | From Windows: wsl -u root |
usermod -aG sudo sam # Debian, Ubuntu, Mint, Raspberry Pi OS
usermod -aG wheel sam # Fedora, RHEL, Rocky, Alma, ArchThe -a matters: without it, -G replaces all your groups. Group changes are read when you log in, so log out completely and back in (or start a fresh shell with su - sam), then run groups to confirm.
On Arch, the wheel rule ships commented out: uncomment %wheel ALL=(ALL:ALL) ALL with visudo.
Editing sudoers safely
Never open /etc/sudoers in a plain editor. A typo there can break sudo for everyone. visudo checks the syntax before saving. Even better, leave the main file alone and add a small file of your own:
visudo -f /etc/sudoers.d/sam
# inside, one line:
sam ALL=(ALL:ALL) ALL
visudo -c # checks every sudoers fileFiles in /etc/sudoers.d should be mode 440 and must not contain a dot or end in ~, or sudo skips them. The number base converter shows what 440 means in bits, and our chmod guide explains the digits.
Broke it already, and sudo now says parse error in /etc/sudoers near line 27? On desktops with polkit, pkexec visudo often still works. Otherwise use recovery mode or su - as above and fix the line.
“sudo: command not found”
| Where | Fix |
|---|---|
| A Docker container (Debian, Ubuntu, Alpine images) | Images don’t include sudo, and you usually run as root already: id -u prints 0. Remove sudo from the command or Dockerfile |
| A container running as a normal user | Put root-only steps before the USER line in the Dockerfile, or run docker exec -u 0 ... |
| A minimal Debian install where you set a root password | The installer skips sudo then. su -, apt install sudo, then add yourself to the group |
| Alpine | apk add sudo, or the smaller doas |
Scripts, CI and passwords
a terminal is required to read the password means nothing can type the password. Run the whole script with sudo from your terminal instead of calling sudo inside it, or allow one exact command without a password in a sudoers.d file: deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp. Avoid NOPASSWD: ALL for anything but throwaway machines. sudo -n fails fast instead of hanging when a password would be needed.
Does “this incident will be reported” mean anything?
It writes a line to the system log (/var/log/auth.log or journalctl), and if the machine has local mail set up, root gets an email. Nobody outside the machine is told.
Related
Used sudo with git and now see dubious ownership? See git dubious ownership. Docker saying permission denied without sudo: docker.sock permission denied. Scripts that won’t run even with sudo: ./script.sh: Permission denied.
Questions
How do I fix user is not in the sudoers file?
Get a root shell another way (su -, the cloud console or recovery mode), run usermod -aG sudo yourname on Debian or Ubuntu or usermod -aG wheel yourname on Fedora, RHEL or Arch, then log out and back in.
Why does sudo still fail after I added myself to the sudo group?
Group membership is read at login. Log out fully and back in, or open a new login shell with su - yourname, then check with groups.
Why is sudo not found in my Docker container?
Base images don't include sudo, and containers usually run as root anyway. Check with id -u; if it prints 0, just drop sudo from the command.
Is it safe to edit /etc/sudoers directly?
Use visudo, which checks the syntax before saving, and prefer a small file in /etc/sudoers.d. A syntax error in sudoers can lock everyone out of sudo.
Published .