Shell New Added 17 October 2026

sudo: a terminal is required to read the password

sudo wanted a password but had no terminal to ask on, because the command ran over ssh without a TTY, from cron, in a CI job or inside an Ansible or Docker step. The same command works when you type it interactively because there you have a terminal and possibly a cached sudo timestamp. The fix is either a terminal, a password from somewhere else, or a narrowly scoped NOPASSWD rule.

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

Quick fix

# Over ssh, force a terminal so sudo can prompt
ssh -t user@host "sudo systemctl restart nginx"

# Check what this user may run without a password
sudo -l -n

# For automation, allow one exact command without a password
echo 'deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx' | sudo tee /etc/sudoers.d/deploy
sudo chmod 440 /etc/sudoers.d/deploy
sudo visudo -c

# Fail fast in scripts instead of hanging on a prompt
sudo -n systemctl restart nginx || echo "sudo needs a password here"

How to diagnose Shell errors

Shell errors are usually about PATH, permissions, or quoting and expansion. The quoting class is the most damaging because it fails silently: an unquoted variable containing a space becomes two arguments, and an empty one disappears entirely. Running shellcheck over any script longer than a few lines catches most of these before they run.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

Trace execution with bash -x script.sh to see each command after expansion. This makes quoting bugs immediately visible.
Start every script with set -euo pipefail so failures stop the script instead of cascading.
Quote every variable expansion: "$var", "${arr[@]}". This single habit prevents the majority of shell bugs.
Use command -v foo to check whether something is on PATH, and echo "$PATH" to see what the shell is actually searching.
In Makefiles, recipe lines must begin with a real tab character. "missing separator" always means spaces were used instead.

Tools worth reaching for

shellcheck
bash -x
set -euo pipefail
command -v
cat -A (to reveal tabs)

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

sudo.ws sudo.ws

Related Shell errors

See all 19 Shell errors →

Browse other categories

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.