Passwordless sudo is useful for automation (CI runners, deploy scripts, cron) where there is no human to type a password. It is configured with the NOPASSWD tag in a sudoers drop-in, edited through visudo:
sudo visudo -f /etc/sudoers.d/deployScope it to specific commands (do this)
The safe pattern is NOPASSWD on exactly the commands the automation runs, never a blanket grant:
# /etc/sudoers.d/deploy
deploy ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart myapp, /usr/bin/systemctl status myapp
Now sudo systemctl restart myapp runs without a prompt, but the account still cannot become root or run anything else without a password. Use absolute paths so a planted binary earlier on PATH cannot satisfy the rule.
The blanket grant (understand the cost)
# Convenient and dangerous: full root, no password, ever
deploy ALL=(ALL) NOPASSWD: ALL
This makes deploy equivalent to passwordless root. Anyone who lands a shell as deploy (a leaked CI token, a compromised key, a web shell running as that user) is instantly root, with no password to slow them down. Only accept this on disposable machines, or where the account is already as trusted as root and tightly isolated.
A safer middle ground for humans
If the goal is just to stop re-typing your password every few minutes, you do not need NOPASSWD at all. Raise the re-prompt timeout instead:
# /etc/sudoers.d/timeout
Defaults timestamp_timeout=60
That caches your sudo authentication for 60 minutes per terminal, so you type the password once an hour rather than once every few minutes, without ever granting password-free root. For most people this is the right answer, and NOPASSWD is reserved for genuine automation.
Verify the rule
sudo -lU deploy # shows which commands are NOPASSWD for deployThe output marks the entries that do not require a password, so you can confirm the scope is exactly what you intended.
FAQ
A blanket NOPASSWD: ALL is, because anyone who gets a shell as that user becomes root with no further barrier. Scoped to specific absolute-path commands it is much safer: the account can run only those commands as root and nothing else. Scope it as tightly as the automation allows.
Raise the timeout instead of granting NOPASSWD: add Defaults timestamp_timeout=60 via visudo. Your authentication is then cached for 60 minutes per terminal, so you type the password far less often while still never having password-free root.
Put the command, by absolute path, after the NOPASSWD tag in a drop-in: deploy ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart myapp. Only that command runs without a password; everything else still requires one.
See also
- How to edit the sudoers file safely (visudo): write this rule without locking yourself out.
- How to give a user sudo access: grant sudo in the first place.
- How to run a command as another user (sudo -u): the automation that often wants NOPASSWD.
- How to disable root login: the keys-and-sudo model NOPASSWD plugs into.
- the sudo lecture: still shown unless you turn it off.
Sources
Authoritative references this article was fact-checked against.
