How to configure passwordless sudo on Linux

Passwordless sudo reduces friction for routine administrative work in Linux by removing repeated password prompts for trusted accounts. This behavior is particularly useful on single-user workstations, development machines, and automation hosts where privileged commands run frequently or non-interactively.

The sudo mechanism consults the main /etc/sudoers file and optional include files under /etc/sudoers.d to decide which users or groups may execute specific commands and whether authentication is required. The visudo helper edits these files safely, locking the configuration and performing a syntax check before installing any changes.

Granting passwordless sudo broadens the impact of any compromise of those accounts, so configuration should be restricted to well-understood users or groups and applied only where operationally necessary. Changes must always go through visudo to avoid syntax errors that could disable sudo entirely on a Linux system.

1. Open a terminal on the target Linux system.
2. Check if the account already has sudo privileges.

   $ sudo -l -U opsuser
   Matching Defaults entries for opsuser on linux-lab:
       env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
   
   User opsuser may run the following commands on linux-lab:
       (ALL : ALL) ALL

   This step confirms that the account is allowed to use sudo before changing any configuration.

3. Use the visudo command to open the main /etc/sudoers configuration file.

   $ sudo visudo

   Editing /etc/sudoers without visudo risks syntax errors that can break sudo for all users.

4. Add a rule for the chosen account that permits passwordless sudo access.

   opsuser       ALL = (ALL) NOPASSWD: ALL

   Replace opsuser with the actual username, or use %groupname to grant the same access to every member of a group.

5. Exit the editor to save changes so that visudo can validate and install the updated configuration.
6. Verify the updated permissions for the account using sudo -l again.

   $ sudo -l -U opsuser
   Matching Defaults entries for opsuser on linux-lab:
       env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
   
   User opsuser may run the following commands on linux-lab:
       (ALL : ALL) ALL
       (ALL) NOPASSWD: ALL

   The presence of NOPASSWD: ALL confirms that passwordless sudo is active for this account.

7. Run a privileged command with sudo to confirm that no password prompt appears.

   $ sudo ls -la /root
   total 52
   drwx------  1 root root 4096 Dec 29 02:25 .
   drwxr-xr-x  1 root root 4096 Dec 29 02:54 ..
   -rw-------  1 root root    5 Dec 28 20:55 .bash_history
   -rw-r--r--  1 root root 3216 Dec 29 02:56 .bashrc
   drwxr-xr-x  2 root root 4096 Dec 28 11:37 .cache
   drwx------  4 root root 4096 Dec 28 11:42 .config
   drwxr-xr-x  3 root root 4096 Dec 28 11:35 disk
   drwxr-xr-x  2 root root 4096 Dec 29 02:53 Downloads
   drwxr-xr-x  3 root root 4096 Dec 28 11:37 .local
   -rw-r--r--  1 root root  161 Apr 22  2024 .profile
   drwxr-xr-x 24 root root 4096 Dec 29 02:51 sg-work
   drwx------  1 root root 4096 Dec 28 20:55 .ssh

   Granting passwordless sudo means any process under this account can run privileged commands without authentication; apply this configuration only to trusted environments.