Learn Linux wheel group usage [With Examples]

Operating systems have a user with full privileges. However, since this user cannot be shared with the people logged into that system, they temporarily share some of their privileges with other users.
On Linux systems, the root user is the most authorized user. There is the sudo/wheel group for other users to use some of the privileges.
This group, which is called sudo in Debian based systems, is called wheel in Redhat and Arch base systems.

Users are taken to this group and authorized.

Configuring Wheel Group in sudoers File

In the sudoers file, the wheel group is disabled in many Linux distributions. Even if the user is in this group, the following warning appears when he wants to perform an authorized transaction:

foc@fedora:~$ sudo cat /etc/sudoers | grep wheel
[sudo] password for foc: 
foc is not in the sudoers file.  This incident will be reported.

Status in sudoers file:

## Allows people in group wheel to run all commands
# %wheel ALL=(ALL) ALL

## Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL

This issue is resolved by removing the # sign at the beginning of the %wheel lines. Users who are in the wheel group in the first wheel line can run all commands with their own passwords. In the second wheel line, users do not need to enter a password:

#%wheel ALL=(ALL) NOPASSWD: ALL

Opening this line is not recommended for security reasons.

It can open the sudoers file with an editor(vi,nano etc):

[root@fedora faruk]# nano /etc/sudoers

or you can use visudo command:

[root@fedora faruk]# visudo

Open the first line in the sudoers file and try the same action again:

[root@fedora faruk]# visudo

foc@fedora:~$ sudo cat /etc/sudoers | grep wheel
## Allows people in group wheel to run all commands
%wheel	ALL=(ALL)	ALL
# %wheel	ALL=(ALL)	NOPASSWD: ALL

Prevent wheel group users from changing root password

Wheel group users get root privileges temporarily. This authorization includes changing the root password. To prevent this, the sudoers file should be written like this:

%wheel ALL=(ALL) ALL, !/usr/bin/passwd root

After this operation, the user cannot change the root password even if user is in the wheel group:

faruk@fedora:~$ sudo passwd root
Sorry, user faruk is not allowed to execute '/usr/bin/passwd root' as root on fedora.

Wheel Group Operations for Users

There are 2 methods to add/remove users to the wheel group. One is to use a command for this job, and the other is to manually edit the /etc/group file.

Add/Remove Users to the wheel group by editing the group file

Edit the /etc/groups file with a text editor (vim, nano etc) in the terminal:

Type users in the wheel group line, one after the other, with a comma(",") between them.

Then, type sudo at the beginning of the commands you will type in the terminal to perform authorized action with the user. After the user enters his password, the action will take place:

[user1@fedora ]$ sudo cat /etc/sudoers
[sudo] password for user1: 
## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
...

To remove the user from the group, it is sufficient to delete the user from the wheel group line again. This step will prevent that user from taking authorized actions.

Add/Remove User from Wheel Group with Command

You have many alternatives for adding/removing users to the wheel group in Linux. When creating the user, you can create it by adding it to the wheel group with the adduser command:

[root@fedora faruk]# adduser user2 -G wheel

The added user is in the wheel group:

[root@fedora faruk]# cat /etc/group | grep wheel
wheel:x:10:foc,faruk,user1,user2

or

[root@fedora faruk]# groups user2
user2 : user2 wheel

If the user is already added and you just want to put them in the wheel group, use the usermod command:

[root@fedora faruk]# usermod -aG wheel omer

The user is also included in the wheel group like this:

[root@fedora faruk]# cat /etc/group | grep wheel
wheel:x:10:foc,faruk,user1,user2,omer

To remove the user from the wheel group, use the gpasswd command:

[root@fedora faruk]# gpasswd -d user1 wheel
Removing user user1 from group wheel

This way user user1 is removed from wheel group:

[root@fedora faruk]# cat /etc/group | grep wheel
wheel:x:10:foc,faruk,user2,omer

What you should do NEXT?

10 practical examples to add or remove user from group in Linux
How to add user to sudoers with best practices & examples

Summary

As we mentioned above, wheel group users are the most authorized users after root user. Care should be taken when adding/removing a user from this group.
Before adding/removing the wheel group, it should be ensured that the root password is known or you should switch to root user by logging in with an authorized user in a different terminal. Otherwise, you may lose all your privileges in that system.

In our article, we gave information about wheel, which is the super user authorization group in Linux.

References

linux.die.net - sudoers(5) - Linux man page
unix.stackexchange.com - How do I add a user to a group