Fix: user is not in the sudoers file

alice is not in the sudoers file.  This incident will be reported.
alice is not in the sudoers file.
Sorry, user alice is not allowed to execute '/usr/bin/apt update' as root on server1.

sudo only works for users listed in /etc/sudoers or in a file under /etc/sudoers.d/, directly or through a group. Your user is not covered by any rule, so sudo denies the command and logs the attempt. The ominous “will be reported” means a line in the auth log and possibly a mail to root, nothing more.

Cause 1: the user was never added to the admin group

A user created with adduser or useradd is a plain user. Distributions grant sudo through a group: sudo on Debian and Ubuntu, wheel on RHEL, Fedora, Alma, Rocky, Arch and openSUSE, admin on macOS. You need root, or another user who already has sudo, to add the group.

# From a root shell or a user that already has sudo
sudo usermod -aG sudo alice      # Debian, Ubuntu
sudo usermod -aG wheel alice     # RHEL, Fedora, Arch, openSUSE

# Check the rule actually exists for that group
sudo grep -E '^%(sudo|wheel)' /etc/sudoers /etc/sudoers.d/* 2>/dev/null

Careful: usermod -G without -a replaces all the user’s supplementary groups instead of adding one. Always write -aG.

The user must log out and back in (or start a fresh SSH session) before the new group applies; id alice or groups shows whether it is there. A running desktop session keeps the old group list.

Cause 2: the group exists but is commented out in sudoers

On some minimal installs, the %wheel line in /etc/sudoers is commented out. Edit sudoers only with visudo, which checks the syntax before saving; a syntax error in that file locks everyone out of sudo.

sudo visudo
# uncomment one of:
# %wheel ALL=(ALL:ALL) ALL
# %sudo  ALL=(ALL:ALL) ALL

# Or add a drop-in for a single user
echo 'alice ALL=(ALL:ALL) ALL' | sudo tee /etc/sudoers.d/alice
sudo chmod 0440 /etc/sudoers.d/alice
sudo visudo -c                   # syntax check all files

Cause 3: there is no one with sudo left

If this is the only account and root has no password (Ubuntu’s default), you need a root shell another way. Options, from least to most invasive: su - if root has a password; log in on the console as root; a cloud provider’s serial console or rescue mode; or reboot into single-user or recovery mode (GRUB, choose the recovery entry, then root shell) and run the usermod command there. On a VM, mounting the disk from another VM and editing /etc/group works too.

# In recovery mode the root file system may be read-only
mount -o remount,rw /
usermod -aG sudo alice
reboot

Cause 4: a restricted rule, not a missing one

is not allowed to execute '/usr/bin/apt' as root means your user has sudo for some commands but not this one. sudo -l lists what you may run. Ask the administrator to extend the rule rather than working around it.

Check that it is fixed

id                   # the group is listed (after a new login)
sudo -l              # shows (ALL : ALL) ALL or the allowed commands
sudo -v              # asks for your password and succeeds silently

When it is not what you think

• sudo: command not found means sudo is not installed at all (common on minimal Debian and in containers). Use su - and apt install sudo.
• sudo: /etc/sudoers is owned by uid 1000, should be 0 or sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set is a permission mess on the sudo files themselves, usually from a reckless chown -R or chmod -R; fix from a root shell with chown root:root /etc/sudoers && chmod 0440 /etc/sudoers and chmod 4755 /usr/bin/sudo.
• Sorry, try again. is a wrong password, and on Ubuntu it asks for your password, not root’s.
• In Docker containers there is usually no sudo and you are already root; use docker exec -u 0 if you are not.

Official documentation

• sudoers(5) manual page
• visudo(8) manual page
• usermod(8) manual page