Users, root, and what sudo actually does

root is the account with user id 0 that permission checks skip. sudo lets a member of the sudo group borrow root for one command, and writes it down.

Every command you have run so far, you ran as somebody. The same command, typed by two different accounts, gives two different answers. Run these as root, then as intern, and watch the box change its mind about you.

Logged in as
$ id
uid=0(root) gid=0(root) groups=0(root)
can do anything

Those first three lines are not from you. They are real probes captured on a real Ubuntu box that had been alive for 105 seconds. Nobody knew it existed. That is the baseline noise every public server sits in, which is the whole reason the account you run things as matters.

What you just learned

Root is just the account whose user id is 0, and the permission checks from block 03 do not apply to it. That is the entire difference. There is nothing else special about it, which is exactly why every attacker in the auth.log you just opened is trying to become it.

sudo is not a password prompt, it is a membership check. Being in the sudo group is what earns you the right to borrow root for one command. Your own password is what proves you are you. And every attempt, granted or refused, gets written down with your username on it.

This is also why your app should not run as root. A process running as www-data that gets compromised can wreck what www-data owns. The same process running as root can wreck the machine. Same bug, different blast radius.

root is not the boss, it is the master key. sudo is the sign-out sheet at the front desk: you can borrow the key, and there is a line with your name on it either way.
You can name it now: say this to your AI
Create a non-root user for my app, put it in the sudo group, and change my service so it runs as that user instead of root.
This is the request that quietly removes a whole class of disasters from your server. You could not ask for it before you knew the difference.

Seen on a real server

intern is not in the sudoers file.
Ubuntu 24.04's refusal (the old 'This incident will be reported' line is gone). The user is not in the sudo group: usermod -aG sudo intern, then log in again.
sudo: intern : user NOT in sudoers ; PWD=/home/intern ; USER=root ; COMMAND=/usr/bin/whoami
What the refused attempt writes into /var/log/auth.log, with the username on it.

You now know who is running things. Next: how the outside world actually reaches them, and which doors you left open.