User Is Not in the sudoers File: Fix It on Debian and Ubuntu

Updated: 12 October 2026 · Applies to: Debian 13 and 12, Ubuntu 22.04, 24.04 and 26.04; tested on Debian 13 (sudo 1.9.16p2), Ubuntu 22.04 (sudo 1.9.9), Ubuntu 24.04 (sudo 1.9.15p5) and Ubuntu 26.04 (sudo-rs 0.2.13 and sudo.ws 1.9.17p2)

Short answer: “alice is not in the sudoers file” means your account has no right to use sudo. On Debian and Ubuntu, an administrator (root) fixes it by adding the user to the sudo group, then the user logs out and back in:

usermod -aG sudo alice

You cannot fix it from the account that gets the error, because that needs sudo. Use root (su -), another admin account, or one of the recovery options below.

What the error looks like

The text depends on the sudo version. From our lab containers:

# Debian 13, Ubuntu 24.04 (sudo 1.9.10 and later)
[sudo] password for alice:
alice is not in the sudoers file.

# Ubuntu 22.04 (sudo 1.9.9 and older)
alice is not in the sudoers file.  This incident will be reported.

# Ubuntu 26.04 (default sudo-rs), shown without asking for a password
sudo: I'm sorry alice. I'm afraid I can't do that

# a user with a sudo rule, but not for this command (sudo 1.9.x)
Sorry, user bob is not allowed to execute '/usr/bin/whoami' as root on vps.

(Shortened: the container also printed an audit warning that does not appear on a normal server; host names are shown as vps.)

Ubuntu 26.04 uses sudo-rs as sudo; the classic program is still installed as sudo.ws and prints the familiar “not in the sudoers file” text. Both use /etc/sudoers, which includes /etc/sudoers.d/ (in our test sudo-rs applied a rule from that folder), so the fix is the same.

“This incident will be reported” means sudo logged the attempt (and can email root if a mail program is set up). According to the sudo release notes, sudo 1.9.10 dropped that sentence and only says “This incident has been reported to the administrator.” when mail is configured. The log entry looks like this (lab output, Ubuntu 24.04 with rsyslog, timestamp and host name shortened):

$ sudo grep 'NOT in sudoers' /var/log/auth.log
... sudo:    alice : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/whoami

On Debian 13, which keeps logs in the journal, sudo journalctl -t sudo showed the same line in our test. In our Ubuntu 26.04 test, sudo-rs refused without writing a line to /var/log/auth.log, while sudo.ws did.

Fix it as root (add the user to the sudo group)

1. Become root. On Debian, if you set a root password during installation, type su - and enter the root password (not your own). If you get su: Authentication failure, root has no password (the Ubuntu default): go to “No root password” below.
2. Install sudo if it is missing (Debian installs without it when you set a root password, according to the Debian installation guide, and minimal images often lack it):

   apt update && apt install sudo

3. Add the user to the sudo group and check:

   usermod -aG sudo alice
   id -nG alice              # alice sudo

   Keep the -a: usermod -G sudo without it removes the user from all other groups. adduser alice sudo does the same where the adduser package is installed.
4. Check that the group rule exists. Debian and Ubuntu ship it in /etc/sudoers; Ubuntu also keeps an old %admin rule. On Ubuntu 24.04:

   $ grep -E '^%(sudo|admin)' /etc/sudoers
   %admin ALL=(ALL) ALL
   %sudo	ALL=(ALL:ALL) ALL

   If the %sudo line is missing or starts with #, members of the group still get “not in the sudoers file” (we tested this). Restore it with visudo.
5. Log out and back in (or open a new SSH session). Group changes apply to new logins only. In our test, a shell that was already open still showed alice as the only group and still got the error after usermod; a new login showed alice sudo.
6. Test:

   sudo whoami               # root
   sudo -l                   # what alice may run

As root you can check any user without switching to them: sudo -l -U alice. For a user without rights it prints User alice is not allowed to run sudo on vps.

No root password and no other admin account

• Ucartz VPS: set a new root password from the client area (change the VPS root password or reset it in Virtualizor), log in as root over SSH or through the console (VNC in Virtualizor), then run steps 3 to 6.
• Ubuntu recovery mode (needs the server console, such as VNC or IPMI): according to Ubuntu’s documentation, reboot, hold the right Shift key (or press Esc on UEFI systems) until the GRUB menu appears, choose Advanced options for Ubuntu, then the recovery mode entry, then Drop to root shell prompt. The disk is read-only there, so run mount -o remount,rw /, then usermod -aG sudo alice and reboot.
• On a dedicated server, use the IPMI console instead of VNC, for example the Supermicro IPMI HTML5 console.

Other causes of the same error

• Old session: the user was added but has not logged in again.
• Wrong group name: on AlmaLinux, Rocky Linux and RHEL the group is wheel, not sudo. See add a user to the wheel group.
• Limited rule: “Sorry, user bob is not allowed to execute ...” means bob has a rule, but not for that command. Extend the rule (below) or add him to the group.
• Broken sudoers file: a parse error message is a different problem: fix a broken sudoers file.

Give limited rights instead

To allow only specific commands, create a file in /etc/sudoers.d/ with visudo, which checks the syntax before saving:

sudo visudo -f /etc/sudoers.d/alice-nginx

alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx

Afterwards, sudo -l for alice lists (ALL) NOPASSWD: /usr/bin/systemctl restart nginx. Files in /etc/sudoers.d/ should have permissions 0440. Check everything with sudo visudo -c: classic sudo lists each file as parsed OK (the sudo-rs version on Ubuntu 26.04 printed one line, /etc/sudoers: parsed OK). A syntax error can stop sudo working for everyone, so always edit with visudo.

Remove sudo rights

sudo gpasswd -d alice sudo
sudo rm /etc/sudoers.d/alice-nginx

More: sudo without a password, the difference between su and su - and root login over SSH.

Official documentation: sudoers manual (Debian 13), sudo-rs manual (Ubuntu 26.04).