How to Run sudo Without a Password (sudoers NOPASSWD)

Updated: 11 October 2026 · Applies to: sudo 1.9.15p5 (Ubuntu 24.04), sudo-rs 0.2.13 and sudo 1.9.17p2 (Ubuntu 26.04), sudo 1.9.16p2 (Debian 13) and sudo 1.9.17p2 (AlmaLinux 10), tested

To run sudo without a password, give the user the NOPASSWD tag in a sudoers file. Create a drop-in file with visudo, which checks the syntax before saving:

sudo visudo -f /etc/sudoers.d/alice

Add this one line (replace alice with the user name), save and close:

alice ALL=(ALL) NOPASSWD: ALL

Test it with sudo -n whoami. The -n option never asks for a password: it prints root when NOPASSWD works, and sudo: a password is required when it does not (on Ubuntu 26.04: sudo: interactive authentication is required).

Set up passwordless sudo step by step

1. Log in as root or as a user that can already use sudo.
2. Open a new drop-in file: sudo visudo -f /etc/sudoers.d/alice. Use a file name without a dot: sudo skips files in /etc/sudoers.d whose names contain a . or end in ~. In our test, a rule saved as /etc/sudoers.d/bob.conf was ignored without any warning.
3. Add the rule for one user, or for a group (put % before the group name):

   alice ALL=(ALL) NOPASSWD: ALL
   %deploy ALL=(ALL) NOPASSWD: ALL

4. Save. visudo checks the syntax and only saves a valid file. In our tests it created the new file owned by root with mode 0640; the usual mode is 0440, so set it: sudo chmod 0440 /etc/sudoers.d/alice.
5. Check the whole configuration and the user’s rights:

   $ sudo visudo -c
   /etc/sudoers: parsed OK
   $ sudo -l -U alice
   User alice may run the following commands on vps:
       (ALL : ALL) ALL
       (ALL) NOPASSWD: ALL

   This is sudo-rs on Ubuntu 26.04; classic sudo also lists the matching Defaults first. The first rule comes from the sudo group, the second from the new file. The NOPASSWD rule wins because it is read last (see below).

visudo opens vi on AlmaLinux and the system default editor on Debian. To pick an editor, set EDITOR (all four systems honoured it): sudo EDITOR=nano visudo -f /etc/sudoers.d/alice.

The sudoers NOPASSWD syntax

user  host=(run_as_user:run_as_group)  TAG: command, command

• user: a user name, %group or an alias.
• host: the machines the rule applies to; ALL on a single server.
• (run_as): who the command may run as; (ALL) means any user, (root) only root.
• NOPASSWD: no password for the commands after it. PASSWD: switches the password back on for the commands that follow on the same line.
• command: ALL or full paths such as /usr/bin/systemctl. Find the path with command -v systemctl.

The colon after NOPASSWD is required. Without it visudo refuses the file; classic sudo printed syntax error, and sudo-rs on Ubuntu 26.04 printed:

/root/bad.tmp:1:24: syntax error: expecting ':' but found 'A'
bob ALL=(ALL) NOPASSWD ALL
                       ^
visudo: invalid sudoers file

Why sudo still asks for a password

• A later rule overrides yours. According to the sudoers manual, when several entries match, the last match is used. In our test we added alice ALL=(ALL) NOPASSWD: ALL to /etc/sudoers above the %sudo ALL=(ALL:ALL) ALL line. alice is in the sudo group, so the group line matched last and sudo still asked for a password. On all four systems we tested, the line that reads /etc/sudoers.d is the last line of /etc/sudoers, which is why a drop-in file wins.
• The file name contains a dot (alice.conf, alice.bak): rename it.
• The rule names a different command path from the one you run. Check with sudo -l.
• The file belongs to the wrong owner. sudo ignored /etc/sudoers.d/alice when it was not owned by root: sudo: /etc/sudoers.d/alice is owned by uid 1000, should be 0.

Passwordless sudo for one command only

Safer than NOPASSWD: ALL: allow only the commands a script or deploy user really needs, with full paths and fixed arguments:

%deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx, /usr/bin/systemctl reload nginx

In our test a member of deploy could run exactly those two commands without a password, and sudo -n systemctl status nginx was refused. To mix both kinds on one line, put ALL first and the password-free command last, because the last match wins inside a line too: alice ALL=(ALL) PASSWD: ALL, NOPASSWD: /usr/bin/apt update. In our test the reverse order (NOPASSWD: /usr/bin/apt update, PASSWD: ALL) still asked for a password for apt update.

Careful with chown, editors and wildcards. A rule like the one below looks limited, but on classic sudo it is not:

bob ALL=(root) NOPASSWD: /usr/bin/chown www-data\:www-data /var/www/html/*

According to the sudoers manual, a wildcard can match any character, including spaces. In our test on classic sudo 1.9.17p2, sudo chown www-data:www-data /var/www/html/index.html /etc/shadow was accepted and changed the owner of /etc/shadow. sudo-rs (the default sudo on Ubuntu 26.04) does not allow this at all: visudo stopped with syntax error: wildcards are not allowed in command arguments. Never give password-free access to commands that can change any file or start a shell, such as chown, chmod, cp, tee, editors or bash: each of them is full root access. Put the job in a root-owned script instead and allow only that script (see run shell scripts with sudo).

Passwordless sudo for the sudo or wheel group

On Debian and Ubuntu, administrators are in the sudo group; on AlmaLinux, Rocky Linux and RHEL, in wheel. AlmaLinux 10 already has the line in /etc/sudoers, commented out:

## Same thing without a password
# %wheel	ALL=(ALL)	NOPASSWD: ALL

Rather than editing /etc/sudoers, add %wheel ALL=(ALL) NOPASSWD: ALL (or %sudo ...) to a drop-in file. On AlmaLinux the #includedir /etc/sudoers.d line is an instruction, not a comment; Debian and Ubuntu write it as @includedir. To add a user to the group first, see add a user to sudo on Debian or add a user to the wheel group.

Useful sudoers options (Defaults)

Options go on Defaults lines, for everybody or for one user (Defaults:alice ...). All of these passed visudo on classic sudo and on sudo-rs:

• Defaults timestamp_timeout=30: minutes before sudo asks again (the sudoers manual gives 15 by default); 0 asks every time. See keep the sudo password session longer.
• Defaults pwfeedback: show asterisks while typing (details).
• Defaults passwd_tries=5: password attempts before sudo gives up.
• Defaults env_keep += "EDITOR": keep a variable from your environment.
• Defaults insults: a joke message after a wrong password (example).

Classic sudo has more options. sudo-rs on Ubuntu 26.04 rejected logfile, requiretty and !authenticate with unknown setting, so use the NOPASSWD tag rather than Defaults:alice !authenticate, which works only on classic sudo. Ubuntu 26.04 installs both: sudo-rs is the default and classic sudo is /usr/bin/sudo.ws. To make classic sudo the default, run sudo update-alternatives --config sudo.

Fix sudoers ownership (sudo stops working)

A recursive chown or chmod on /etc breaks sudo. These are the messages from our tests after the file was given to user 1000:

sudo: /etc/sudoers is owned by uid 1000, should be 0           # classic sudo
sudo: invalid configuration: /etc/sudoers must be owned by root  # sudo-rs

sudo cannot repair itself, so log in as root (SSH as root or the server console) and reset the owner and mode:

chown root:root /etc/sudoers /etc/sudoers.d/*
chmod 0440 /etc/sudoers /etc/sudoers.d/*
visudo -c

For syntax errors after a manual edit, see fix a broken sudoers file.

Is passwordless sudo safe?

With NOPASSWD: ALL, anyone or anything that runs as that user becomes root without knowing a password: a stolen SSH key, a hijacked terminal or a compromised application. Use it for automation accounts that log in with SSH keys only, keep the rules as narrow as possible, and never give it to the web server user (www-data, apache, nginx). To undo it, delete the drop-in file (sudo rm /etc/sudoers.d/alice) and run sudo -k to forget the cached login.

Official documentation: sudoers manual and visudo manual.