Fill in the form and get the exact commands for your Linux distribution: create a user, add their SSH key, give sudo rights (everything, or just a few commands), lock an account or remove it. Sudo rules go into their own file in /etc/sudoers.d and are checked with visudo first, so a typo can’t lock you out. You can also paste any sudoers line to have it explained.

RUNS ENTIRELY IN YOUR BROWSER · NOTHING IS SENT ANYWHERE

Your system

Which group gives sudo?

Distribution	Group	Notes
Debian, Ubuntu, Mint	`sudo`	Members of `sudo` can use sudo out of the box.
RHEL, Rocky, Alma, Fedora, CentOS	`wheel`	Members of `wheel` can use sudo out of the box.
Arch, Manjaro	`wheel`	The `%wheel` line in /etc/sudoers ships commented out; turn it on with a file in /etc/sudoers.d.
openSUSE, SUSE	`wheel`	New installs let wheel members use their own password (package `sudo-policy-wheel-auth-self`); older ones ask for root’s password.
Alpine	`wheel`	sudo isn’t installed by default (`apk add sudo`), and the `%wheel` line is commented out.

sudoers rules worth knowing

Put your own rules in a file in /etc/sudoers.d/, not in /etc/sudoers itself, so package updates don’t overwrite them.
Files there whose names contain a dot or end in ~ are silently skipped: /etc/sudoers.d/deploy.conf does nothing.
Always check a rule with visudo -c before it goes live. One typo in a sudoers file can stop sudo working for everyone.
When several rules match, sudo uses the last one it reads, not the most specific one.
#includedir /etc/sudoers.d is not a comment. Newer sudo writes it as @includedir; both work.
Commands need their full path, like /usr/bin/systemctl. Find it with command -v systemctl.
Editors, pagers, shells, find, tee and script interpreters can all reach a root shell. To let someone edit a file, allow sudoedit /path/file instead.
sudo -l -U name lists what a user may run.