This means your user doesn't have permission to use sudo. The fix is to add it to the right group — but you need an account that already has root/sudo to do it. Here is both.
Quick answer
"User is not in the sudoers file" means your account is not allowed to use sudo. Log in as root (or another sudo user) and add it to the admin group: usermod -aG sudo username on Debian/Ubuntu, or usermod -aG wheel username on RHEL, AlmaLinux and Rocky. Log out and back in for it to apply. Never edit /etc/sudoers directly — use visudo.
Add the user to the sudo group
As root (or another sudo user), add your user to the admin group. Which group depends on your distro:
| Distro | Admin group | Command |
|---|---|---|
| Debian / Ubuntu | sudo | usermod -aG sudo username |
| RHEL / AlmaLinux / Rocky / CentOS | wheel | usermod -aG wheel username |
| Arch | wheel | usermod -aG wheel username (+ enable in visudo) |
# Debian/Ubuntu
usermod -aG sudo username
# RHEL/Alma/Rocky
usermod -aG wheel username
# then log out and back inNo root or sudo access at all?
If no account can elevate, use your provider's VNC/serial console or boot to single-user/rescue mode to log in as root, then run the command above.
Never edit /etc/sudoers directly — a syntax error locks everyone out of sudo. Always use visudo, which validates the file before saving.
"sudo: command not found"
That's different — sudo isn't installed. As root: apt install sudo or dnf install sudo.
Add the user to sudo (Debian) or wheel (RHEL) as root, re-login, and always edit sudoers with visudo.
Cause: sudo installed but the group name differs
A minimal or custom Linux image sometimes uses a non-default admin group name, or ships without sudo group membership pre-wired even though sudo itself is installed. Check which group actually grants access on your distro (look inside /etc/group for sudo or wheel) before adding the user.
Granting access to only specific commands (least privilege)
Full sudo access isn't always appropriate. For a service account that only needs to restart one service, add a narrow rule via visudo instead of full group membership — for example allowing only a specific systemctl restart command without a password, rather than blanket root.
How to prevent sudo lockouts
- Always keep at least one account (or your host's console access) with confirmed working sudo/root before removing another.
- Test a new sudoers rule in a second terminal session before closing the one that still has access.
- Never edit /etc/sudoers directly — always visudo.
- Document who has sudo and why, especially on shared team servers.
Related errors
Locked out over SSH specifically, not sudo? See SSH permission denied (publickey). For a full lockdown checklist including SSH keys and sudo, see how to harden SSH and how to secure a Linux VPS.