fren
Log In

Understanding root, sudo and Linux users

2 min read07 November 2026

On a VPS, root can do everything: change the system's logical core, delete files, alter permissions, listen on ports. Working as root all the time multiplies the consequences of a typo. sudo exists to grant that power briefly to a named account, without sharing the root password.

root, the UID 0 user

root is identified by UID 0, not by its name. Kernel permission checks compare numeric identifiers: renaming the account changes nothing about its power. root bypasses most permission checks and can read, write and delete almost anything.

Bash
id
whoami

id shows the UID, GID and groups. A named account has a UID above 1000; root has uid=0(root). The 0 matters, not the word "root".

sudo, a one-command delegation

sudo runs a command with another user's privileges, root by default. You authenticate with your password, not root's, and the power lasts only for that command.

Bash
sudo systemctl restart nginx
sudo -l
sudo -i

sudo -l lists what your account may run. sudo -i opens a full root shell: handy, but return to your account afterwards. sudo -s does the same without resetting the environment, which can surprise you with PATH.

The sudo group and sudoers

On Debian 13, members of the sudo group get full rights through a rule shipped in /etc/sudoers. To grant sudo:

Bash
sudo usermod -aG sudo utilisateur

The user must log in again for the new group to apply. For a narrower rule, create a file in /etc/sudoers.d/ and edit it only with visudo -f. visudo checks syntax: an error in that file can lock you out of sudo.

Sessions and audit trail

sudo logs the command, the user and the time. With journald:

Bash
journalctl SYSLOG_IDENTIFIER=sudo --since today

An open root session stays active even after a password change. Close unused shells and never leave a root terminal in a shared multiplexer. su - asks for the root password and opens a full environment; prefer sudo -i when your account is already authorised.

Best practices

  • One named account per person, never a shared account.
  • root reserved for repairs, not daily work.
  • sudo for precise commands, not sudo bash out of habit.
  • No chmod 777 to "make a service work".
  • Check sudo -l after every rights change.
  • Disable direct SSH root login once a sudo user is tested.

Advertisement

Was this article helpful?

Read next