Linux · Accounts & Family

Manage user accounts, sudo access, and group membership

Linux permissions are built around users and groups rather than per-app toggles — adding a user to a group (like `sudo`, `wheel`, or `docker`) is how most access is granted, and it's managed the same way whether you're using a GUI Settings panel or the command line.

What you should know

  • GUI: Settings > Users (GNOME) or System Settings > Users (KDE) to add accounts, set admin status, and manage login options.
  • Add a user to a group: `sudo usermod -aG <group> <username>` (Debian/Ubuntu use the `sudo` group for admin rights; Fedora/Arch use `wheel`) — the user must log out and back in for new group membership to take effect.
  • List a user's current groups: `groups <username>` or `id <username>`.
  • Edit sudo rules directly (advanced) with `sudo visudo`, which validates syntax before saving to avoid locking yourself out.

Always keep at least one working admin/sudo-capable account — removing sudo rights from every account, or a syntax error saved outside of `visudo`, can lock you out of admin actions entirely.

Why it matters

Most "permission denied" support requests trace back to a missing group membership (docker, dialout, plugdev) rather than a broken system — understanding groups turns a confusing error into a one-line fix.

Best practices

  • Use a personal admin account for daily work rather than logging in as root directly — `sudo` on a per-command basis is safer and keeps an audit trail.
  • Log out and back in (or reboot) after any group membership change — it does not apply to already-open sessions.
  • Review `/etc/sudoers.d/` for any custom rules before troubleshooting unexpected permission behavior.

Common problems and fixes

"user is not in the sudoers file" error
From an existing admin account, run `sudo usermod -aG sudo <username>` (or `wheel` on Fedora/Arch); if no admin account exists, this needs to be fixed by booting into recovery/single-user mode.
Newly added group membership doesn't seem to work
Log out completely and back in (a new terminal alone isn't enough in most cases) — group membership is set at login time.

Tips and tricks

  • `getent group <groupname>` shows every member of a group system-wide, useful for auditing who has docker or sudo access.

Frequently asked questions

What's the difference between `sudo` and logging in as root?

`sudo` runs a single command with elevated privileges and logs who ran it; logging in as root keeps the whole session privileged, which is easier to make a costly mistake in and is disabled by default on most desktop distros.