User & Group Management

Let devs restart services without handing them the keys to the kingdom

🧩 The Challenge

Ever had a developer or junior admin need to restart just one specific systemd service? You’re staring down the barrel of giving them full sudo systemctl access, which means they can stop critical databases or reboot the server. And nobody wants that headache at 3 AM.

💡 The Fix

There’s a clean way to limit what systemctl commands a user can run with sudo. This makes sure they can only touch what’s needed. But it also saves you from security nightmares and late-night panic calls.

First, find the full path to systemctl: which systemctl (usually /usr/bin/systemctl)

Then, edit your sudoers file with visudo and add something like this:
# Define a command alias for starting/stopping the 'myservice.service'
Cmnd_Alias RESTART_MY_SERVICE = /usr/bin/systemctl restart myservice.service, /usr/bin/systemctl stop myservice.service, /usr/bin/systemctl start myservice.service, /usr/bin/systemctl status myservice.service

# Grant 'devuser' permission to use the defined alias without a password
devuser ALL=(ALL) NOPASSWD: RESTART_MY_SERVICE

⚙️ Why It Works

This works by using Cmnd_Alias in your sudoers file to group precise commands. Then, you grant a user or group permission to execute only that alias. It means the user literally can’t run sudo systemctl reboot because it’s not in their allowed alias.

🚀 Pro-Tip: Combine Cmnd_Alias with User_Alias or Host_Alias for even more powerful, scalable sudoers management.

Linux Tips & Tricks | © ngelinux.com | 11/3/2026