Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a user user1 that is not in the sudoers file (nor belonging to groups in sudoer) but can still use sudo. How is it possible ?

user1~$ groups
        user1 www-data

My sudoer conf

        root ALL=(ALL) ALL
        %sudo ALL=(ALL) ALL

        #includedir /etc/sudoers.d

user1~$ sudo -l
        User user1 may run the following commands on this host:
        (ALL) ALL
share|improve this question
up vote 8 down vote accepted

As you can see, your sudoers file contains a line above which includes a number of other files from /etc/sudoers.d. You may be thinking that the hash symbol in front is a comment, but from man sudoers:

It is possible to include other sudoers files from within the sudoers file currently being parsed using the #include and #includedir directives.

You will need to show us the contents of all files in /etc/sudoers.d/ before we can comment on why user1 has sudo privileges.

share|improve this answer
Thanks, I was sure it was commented out ! There is effectively files in sudoers.d that define additionial rights. – Go4It Feb 12 '14 at 10:48
Whoever thought of using # like that in a config file where a # in all bar one other context means a comment needs a good talking to. – Iain Feb 12 '14 at 10:49
<grin> I agree, but things are even worse: it has another non-comment use: "The pound sign (‘#’) is used to indicate a comment (unless it is part of a #include directive or unless it occurs in the context of a user name and is followed by one or more digits, in which case it is treated as a uid)". Bring forth the cluebat! – MadHatter Feb 12 '14 at 10:53
Yes, that was the one other context I was referring too. – Iain Feb 12 '14 at 11:49
#include is a C-ism. It's not a comment there :) – Bill Weiss Feb 12 '14 at 12:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.