Add a User to wheel for sudo on AlmaLinux, Rocky Linux, RHEL

Updated: 12 October 2026 · Applies to: AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Fedora; tested on AlmaLinux 9.8 (sudo 1.9.17p2) and Rocky Linux 10.2 (sudo 1.9.17p2, shadow-utils 4.15); wheel rule checked on Fedora 44

On AlmaLinux, Rocky Linux, RHEL and Fedora the administrator group is called wheel, not sudo as on Debian and Ubuntu. To give a user full sudo rights, add them to wheel:

usermod -aG wheel alice

This is also the fix for the error “alice is not in the sudoers file” on these systems (see the section on that error below). The steps below create the user first, then check that it works. Run them as root, or with sudo from an account that already has admin rights.

1. Create the user and set a password

useradd -m alice
passwd alice

useradd creates the home folder /home/alice and a private group with the same name. On these distributions adduser is only a link to useradd, so it doesn’t ask questions the way Debian’s adduser does. Always set a password: by default, members of wheel must type their own password when they use sudo.

To create the user and add it to wheel in one go: useradd -m -G wheel alice.

2. Add the user to the wheel group

usermod -aG wheel alice
id alice

Output from our test:

uid=1000(alice) gid=1000(alice) groups=1000(alice),10(wheel)

Never leave out the -a (append). Without it, usermod -G replaces the user’s whole list of extra groups. In our Rocky Linux test, a user in developers and wheel was left in wheel only after usermod -G wheel carol:

groups=1001(carol),10(wheel),1000(developers)   # before
groups=1001(carol),10(wheel)                    # after usermod -G wheel

3. Check the wheel rule in sudoers

The group only works because /etc/sudoers contains this line, which is active by default:

%wheel  ALL=(ALL)       ALL

Check it with grep '^%wheel' /etc/sudoers. If the line starts with #, Red Hat’s documentation says to remove the # with visudo. Just below it is a commented line, %wheel ALL=(ALL) NOPASSWD: ALL, which would let the group use sudo without a password; leave it commented unless you have a good reason.

4. Log in again and test

Group membership is read at login, so the user must log out and in again (or open a new SSH session). Then:

sudo whoami        # root
sudo -l            # lists (ALL) ALL

As root you can check any user without switching: sudo -l -U alice.

A new user also sees the short “We trust you have received the usual lecture” message the first time they use sudo. That is normal.

Fix “user is not in the sudoers file” on AlmaLinux, Rocky Linux and RHEL

A user who is not in wheel (and has no other sudo rule) gets this after typing their password. Lab output from AlmaLinux 9.8, first use of sudo, with one container-only audit warning removed:

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

For security reasons, the password you type will not be visible.

[sudo] password for alice:
alice is not in the sudoers file.

The account itself cannot fix this. Someone with root rights has to add it to wheel:

1. Become root with su - and the root password, not the user’s own password. On a Ucartz VPS, the root login is in your VPS welcome email.
2. Run usermod -aG wheel alice and check with id alice. In our test this showed groups=1000(alice),10(wheel) plus the user’s other groups.
3. Log out and back in as alice. In our test the next login ran sudo whoami as root.

If it still fails: the user may still be in an old session, the %wheel line in /etc/sudoers may be commented out (step 3), or the file may have a syntax error (fix a broken sudoers file).

No root password and no other admin account? On a Ucartz VPS, set a new root password from the client area (change the VPS root password) and log in as root over SSH or the VNC console. Otherwise, Red Hat documents a reset at boot: press e in the GRUB menu, add rd.break to the end of the line that starts with linux, boot, then remount /sysroot read-write and set a new password, according to Red Hat. Follow the full procedure for your RHEL version, as it includes an SELinux relabel step.

On Debian and Ubuntu the group is sudo and Ubuntu 26.04 shows a different message (sudo: I'm sorry alice. I'm afraid I can't do that): see user is not in the sudoers file on Debian and Ubuntu.

Give limited rights instead of wheel

If the user only needs one or two commands, don’t add them to wheel. Create a rule in /etc/sudoers.d/ with visudo, which checks the syntax before saving:

visudo -f /etc/sudoers.d/alice-nginx

alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx

Then visudo -c should show every file as parsed OK. A typo is reported with the file, line and position; when we wrote NOPASWD, it showed /etc/sudoers.d/bad:1:37: syntax error. If sudo stops working after an edit, see how to fix a broken sudoers file.

Remove admin rights or the user

gpasswd -d alice wheel      # Removing user alice from group wheel
userdel -r alice            # delete the user and their home folder

Notes for servers

• If you create the user in the RHEL 10 installer, the option “Add administrative privileges to this user account” is selected by default, according to Red Hat. It does the same as adding the user to wheel.
• Once your admin user works, you can block direct root logins over SSH: see allow or disable root login over SSH. Test a new SSH session with the new user before you close the root session.
• On cPanel servers, WHM has its own page for the wheel group, which controls who may use su: see the Wheel Group Users interface.

Related: add a user to sudo on Debian, add a user to a group in Linux and list users from the command line.

Official documentation: Red Hat: managing sudo access, Red Hat: managing users and groups (includes resetting the root password).