Fix "user is not in the sudoers file. This incident will be reported."

su -                          # needs the root password
usermod -aG sudo alice        # Debian, Ubuntu, Mint
usermod -aG wheel alice       # Fedora, Arch, openSUSE
exit

Classic sudo (Debian, Fedora, Arch, older Ubuntu) prints:

alice is not in the sudoers file.  This incident will be reported.

Recent sudo releases shorten it, and other policies give related wording:

alice is not in the sudoers file.
Sorry, user alice is not allowed to execute '/usr/bin/apt update' as root on myhost.

Ubuntu 26.04 uses sudo-rs, a Rust reimplementation, as its default sudo. Its wording differs from classic sudo; depending on the version it can be a plain "not in the sudoers file" message or the tongue-in-cheek:

sudo: I'm sorry alice. I'm afraid I can't do that

The cause and the fix are identical in every case.

What the error means

sudo checks /etc/sudoers and files in /etc/sudoers.d/ for a rule that lets your account run commands as root. You typed the correct password (otherwise you would see "Sorry, try again"), but no rule matches you. On every major distro the default rule grants sudo to a group, not to individual users:

So the fix is to put your user into that group, from an account that already has root.

Cause 1: your user was never added to the admin group

This is by far the most common case: a Debian install where you set a root password (the installer then skips adding you to sudo), an Arch install where you created the user but not the rule, or a user account someone else created. Check your groups:

id alice

Example output:

uid=1000(alice) gid=1000(alice) groups=1000(alice),24(cdrom),29(audio)

No sudo or wheel in the list. Become root with the root password and add it:

su -
usermod -aG sudo alice      # or: usermod -aG wheel alice
exit

Use su - (with the dash): on Debian, plain su keeps your PATH, which lacks /usr/sbin, so usermod gives command not found. The -a flag matters: -G without -a replaces all your other groups.

Cause 2: you added the group but did not log in again

Group membership is read at login. Your current session keeps the old list, so sudo still refuses. Log out of the desktop completely and back in (or reboot). Confirm with id (no username) in a new terminal; id alice reads the database and shows the new group even before you log in again, which is misleading.

Cause 3: the group rule is disabled (Arch and custom setups)

On Arch, the wheel rule is commented out. As root, edit sudoers with visudo, which checks syntax before saving:

EDITOR=nano visudo
# uncomment this line:
%wheel ALL=(ALL:ALL) ALL

A cleaner alternative is a drop-in file:

echo '%wheel ALL=(ALL:ALL) ALL' > /etc/sudoers.d/10-wheel
chmod 440 /etc/sudoers.d/10-wheel
visudo -c

visudo -c validates all files. A syntax error in sudoers breaks sudo for everyone, which is why you should never edit it with a plain editor.

No root password: recovery options

Ubuntu: recovery mode

Ubuntu locks the root account, so su does not work. Use recovery mode:

1. Reboot and hold Shift (BIOS) or tap Esc (UEFI) to show the GRUB menu.
2. Choose Advanced options for Ubuntu, then the entry ending in (recovery mode).
3. Select root (Drop to root shell prompt) and press Enter.

mount -o remount,rw /
usermod -aG sudo alice
reboot

If recovery mode asks for a root password you never set, use the GRUB edit method or a live USB below.

Any distro: init=/bin/bash

At the GRUB menu press e, find the line starting with linux, add init=/bin/bash at the end, and boot with Ctrl+X. You get a root shell before anything starts:

mount -o remount,rw /
usermod -aG wheel alice     # or sudo on Debian/Ubuntu
touch /.autorelabel         # Fedora / SELinux systems only
sync
reboot -f

On SELinux systems (Fedora, openSUSE Leap 16), files rewritten without the policy loaded, such as /etc/group, lose their labels; /.autorelabel makes the next boot fix them (it takes a few minutes). More on boot parameters in setting kernel parameters.

Live USB and chroot

Boot any live system, mount your root partition, and chroot into it:

sudo mount /dev/nvme0n1p2 /mnt     # your root partition
sudo chroot /mnt usermod -aG sudo alice

Distro notes

• Ubuntu 26.04: sudo-rs reads the same /etc/sudoers and sudo group, so the fix is unchanged. Classic sudo remains available and can be selected with sudo update-alternatives --config sudo if you depend on features sudo-rs lacks.
• Debian: no root password at install means your first user gets sudo automatically; setting one means it does not.
• Fedora: the installer's "Make this user administrator" checkbox adds the user to wheel.
• openSUSE: sudo historically asks for the root password (Defaults targetpw). Leap 16 and current Tumbleweed can be set up for wheel-based sudo; see the openSUSE sudo documentation.
• Mint: same as Ubuntu, but recovery mode may be shown directly in the GRUB menu.

How to prevent it

• Make sure at least two accounts can become root, or keep a root password stored safely.
• Always use usermod -aG (with -a) so you never remove yourself from groups by accident.
• Edit sudo rules only with visudo or visudo -f /etc/sudoers.d/file.

The user management guide covers groups, usermod and sudo rules in depth.

Frequently asked questions