sudo
one command as rootsudo runs one command with another user's privileges, root by default. It asks for your own password, checks a rule file to see whether you are allowed, and records the command in the log. That is the whole point: administration by named people, one visible command at a time.
sudo exists so that nobody has to log in as root — and so that every root action has a name on it.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
You prove who you are; the rules decide what you may do. Nothing is echoed as you type.
(ALL : ALL) ALL means any command, as any user or group. A locked-down account would show a short list of specific commands instead.
Here the command ran as the postgres service account — the right way to do database administration without a root shell.
Who, from which terminal, in which directory, as whom, and the exact command. This log line is what an audit reads.
Switches
A switch changes how the command behaves. These are the ones used day to day; man sudo lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-i- Start a login shell as root, in root’s home directory.
-u USER- Run the command as this user instead of root.
-l- List what you are allowed to run with sudo.
-s- Start a shell as root, keeping your current directory.
-k- Forget the cached password, so the next sudo asks again.
-v- Refresh the cached password without running anything.
-E- Keep your own environment variables for the command.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
sudo !!Re-runs the previous command with sudo — for the moment after "Permission denied".
sudo -kForgets the cached password immediately, so the next sudo asks again.
sudo visudoEdits the rule file with a syntax check, so a mistake cannot lock everyone out.
sudo -iOpens a root shell. Convenient, and it trades away the one-command-at-a-time record.
In cybersecurity
sudo is the gate between an ordinary account and the whole machine, so its rule file is among the most security-relevant files on the system.
A rule that skips the password turns any compromise of that account into root at once. Keep it for narrow, specific commands if at all.
Allowing sudo on an editor, a pager, find or tar hands over a root shell, because each can launch one. Review rules with that in mind.
Grant the commands a role needs, not ALL. And prefer "sudo command" to a root shell, so the log stays meaningful.