Who Can Use sudo?

Two ways to get admin rights

The Users panel covers the first one. The second one is a file, and it is the one people miss.

Way one: the administrators group

Being an Administrator means being in a group called sudo. You already fixed this in the settings panel by switching an account to Standard, which takes them out of that group.

If you want to see the group itself:

sudo nano /etc/group

Find the line that starts with sudo:. The names at the end of that line are your administrators. Compare them to the ReadMe and leave with Ctrl+X.

Way two: a rule written just for one person

There is a folder full of small files, and each one can hand out permissions on its own:

sudo ls /etc/sudoers.d/

Open anything in there that is not called README:

sudo nano /etc/sudoers.d/FILENAME

You are looking for the word NOPASSWD. A line containing it means that user can do anything as an administrator and will never be asked for a password, which defeats the point of having one.

The fix is to delete the file:

sudo rm /etc/sudoers.d/FILENAME

The main rules file

sudo visudo

Use visudo, not nano, for this one file. It checks your typing before saving, and a mistake in this file means nobody can use sudo, including you. There is no way back from that in the middle of a round.

The line you care about should look exactly like this:

%sudo   ALL=(ALL:ALL) ALL

If it has NOPASSWD: in it, take that word out so it matches the line above.

Try it yourself

sudo ls /etc/sudoers.d/               # what is in the folder
sudo nano /etc/sudoers.d/FILENAME     # read anything that is not README