deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp

sudoers Rule Builder

Say who may run what, as whom, and whether they need a password. Get a sudoers.d drop-in and the visudo commands that stop a typo from locking you out of sudo.

/etc/sudoers.d/NAME, with no dots in the name
Options
Drop-in file contents
Install and check

Never edit sudoers with a plain editor

A syntax error in sudoers can disable sudo for everyone, and if root has no password you then need a rescue boot to fix it. visudo checks the file before saving it. Put your rules in a drop-in under /etc/sudoers.d instead of editing the main file, so package updates do not conflict with them. Name the file carefully: sudo silently skips any file there whose name contains a dot or ends with a tilde, so admins.conf is ignored while admins works.

Write sudoers rules safely

This sudoers builder writes rules in the standard who, where, as whom, what format: a user or %group, the host field, the run-as user and group, an optional NOPASSWD tag, and either ALL or a list of commands with absolute paths. It warns about commands that hand out a root shell by accident, such as editors, pagers, and find, suggests sudoedit for file editing, and wraps everything in the visudo commands that validate the file and set its 0440 permissions.

sudoers FAQ

Why must commands use full paths?

sudo matches the command path exactly. A bare name like systemctl is a syntax error in sudoers, and allowing a relative path would let a user put their own program earlier in PATH. Run command -v systemctl to find the real path.

Is NOPASSWD safe?

For a narrow command list, such as one service restart for a deploy user, it is reasonable. For ALL it means anyone who gets that account, through a stolen SSH key or a compromised process, becomes root instantly with no second barrier.

Why is allowing vim or less dangerous?

Many programs can start a shell: vim with :!sh, less with !sh, find with -exec. Running them as root hands out a root shell. To let someone edit a root-owned file, allow sudoedit /path/to/file instead, which edits a temporary copy with the user's own editor and permissions.

How do I see what a user is allowed to run?

sudo -l -U username, run as an admin, lists the rules that apply to that user. Users can check their own with sudo -l.

More Linux command tools

Crontab Generator Build cron schedule expressions visually, with plain-English previews of when your job will run. tar Builder Compose tar archive and extract commands with the right compression flags, without memorizing xvzf incantations. systemd Unit Builder Generate systemd service files with restart policies, dependencies, and sandboxing options. chmod / chown Builder Work out permission octals and ownership commands with a visual rwx matrix. rsync Builder Build rsync sync and backup commands with delete safety, excludes, and SSH transport options. SSH Config Builder Generate ~/.ssh/config host blocks with keys, jump hosts, and connection keepalives. find Builder Compose find commands with type, name, time, and size filters, plus prune lists and safe actions. /etc/fstab Builder Build fstab mount lines with the right options, dump, and pass ordering for disks and network shares. OpenSSL CSR Builder Generate certificate signing request commands with subject fields and SAN entries filled in. journalctl Query Builder Compose systemd journal queries with unit, boot, priority, time-range, and grep filters. docker run Builder Build docker run commands with ports, volumes, env vars, and restart policies. Podman-compatible. ufw Rule Builder Build ufw firewall rules with allow/deny/limit actions, source restrictions, and comments. systemd Timer Builder Generate paired .timer and .service units with OnCalendar schedules, persistence, and randomised delay. WireGuard Config Generator Produce matching server and peer configs with AllowedIPs, DNS, keepalive, and NAT forwarding rules. Reverse Proxy Config Builder Write nginx or Caddy config for a self-hosted service, with TLS, WebSockets, and forwarded headers. Docker Compose Generator Build a docker-compose.yml with volumes, environment, ports, restart policy, and healthcheck. nftables Rule Builder Generate nftables rules and a stateful starter ruleset for the inet filter table. Samba and NFS Share Builder Create an smb.conf share block or an /etc/exports line, with the client mount commands. useradd / usermod Builder Build user creation and modification commands without accidentally wiping group membership. sed Command Builder Compose substitution, deletion, and insertion commands with safe in-place editing and backups. LVM Command Builder Get the full command sequence for creating, extending, and snapshotting logical volumes. restic / Borg Backup Builder Build init, backup, retention, and restore commands for restic or BorgBackup repositories. tcpdump Filter Builder Assemble BPF capture filters by host, port, and protocol, with rotation and Wireshark output. dd Bootable USB Builder Write an ISO to a USB drive, with the device identification and checksum checks to run first. ffmpeg Command Builder Convert, compress, trim, scale, and extract audio with the arguments in the right order. umask Calculator See what a umask produces for new files and directories, and where to set it persistently. GPG Command Builder Verify signed downloads, generate keys, and sign files or git commits without guessing flags. Subnet Calculator Work out network, broadcast, host range, and masks for any IPv4 or IPv6 CIDR block, and split networks into subnets. curl Command Builder Build curl requests with methods, headers, JSON or form bodies, uploads, auth, retries, and timeouts. ssh-keygen Builder Generate Ed25519, RSA, or FIDO2 security key SSH keys, then install them with ssh-copy-id. logrotate Config Generator Generate /etc/logrotate.d files with rotation schedules, retention, compression, and postrotate reloads. Podman Quadlet Generator Turn a container into a systemd service with a Quadlet .container file, rootless or rootful. Netplan Config Generator Write Netplan YAML for static IPs, DHCP, bridges, and VLANs on Ubuntu, applied safely with netplan try. grep Command Builder Build recursive grep searches with regex modes, context lines, and include or exclude filters, plus the ripgrep equivalent.

View all tools →