The “Permission Denied” Wall
The first time a beginner uses a Linux terminal, they inevitably try to install a new piece of software or update the system using a command like apt install nginx. The terminal instantly rejects them, printing a harsh red error: Permission Denied.
Frustrated, the user searches the internet for a solution. The internet tells them to log in as the “root” user—the absolute god-level administrator of the Linux system who is allowed to do anything. So, they log in as root, install the software, and just stay logged in as root forever because it is easier.
This is the most dangerous mistake you can make in Linux. If you are logged in as root and accidentally type the wrong delete command, the system will not warn you; it will instantly destroy the entire hard drive. If a hacker exploits a vulnerability in a web browser you are running as root, they instantly own the entire server.
To prevent this, Linux relies on the sudo (Super User DO) command. It allows you to stay safely logged in as a normal, restricted user, but temporarily borrow the “god-level” powers of root for just one single command.
How Sudo Works
Think of the Linux operating system like a secure corporate office building.
- A Normal User is an employee with a standard keycard. They can enter their own cubicle, read public memos on the bulletin board, and run basic programs. They cannot enter the server room, and they cannot fire other employees.
- The Root User is the CEO, who holds a master skeleton key. They can walk into any room, destroy any file, and shut down the entire building.
When you use the sudo command, you are essentially calling the CEO, proving who you are, and asking them to swipe their master keycard to open a locked door for you just this one time.
Executing a Sudo Command
To use sudo, you simply type it at the very beginning of the restricted command you want to run.
Instead of typing: apt install htop (which will fail with Permission Denied).
You type: sudo apt install htop
When you press Enter, Linux will pause and ask you for a password. Crucially, it is not asking for the Root password; it is asking for your personal user password. It is verifying that the person sitting at the keyboard is actually you, and not someone who sat down while you went to the bathroom.
(Note: When you type your password in a Linux terminal, the cursor will not move, and no asterisks will appear. This is a security feature to hide the length of your password. Just type it and press Enter).
Once verified, the command executes with full administrative privileges. The moment the installation is finished, those god-level powers instantly evaporate, and you are returned to being a safe, normal user.
The Sudoers File (Who is allowed to ask?)
Not every normal user on a Linux system is allowed to use sudo. If you create an account for a junior intern, you do not want them to have the ability to borrow the master key.
Linux manages this via a highly secure configuration file called the sudoers file (located at /etc/sudoers). This file acts as an VIP guest list, explicitly stating which normal users are allowed to use the sudo command.
If you try to run sudo and you are not on that list, Linux will reject the command, block your access, and usually log the security violation to a system file.
To add a user to the VIP list, a system administrator must use a specific tool to edit the file (usually by typing visudo) or add the user to a specific security group (like the ‘wheel’ group on CentOS or the ‘sudo’ group on Ubuntu).
Conclusion
Never log into a Linux server directly as the root user. By using a standard account and prefixing your administrative tasks with the sudo command, you create a vital safety net that protects the operating system from catastrophic accidents and malicious software.