# Command - Cmnd_Alias

<p class="callout info">Last verified: October 2026 against the sudoers manual (sudo.ws).</p>

### What is Cmnd\_Alias?

Cmnd\_Alias (Command Alias) is a feature in /etc/sudoers (and files in /etc/sudoers.d/) that lets you **group multiple commands** under a single, easy-to-read name.

Instead of repeating long command paths many times, you define the group once and then reference the alias name in your user permission rules. This makes the sudoers configuration:

- Much cleaner and more readable
- Easier to maintain (add/remove commands in one place)
- Less error-prone

It is one of four main alias types in sudoers:

- User\_Alias — groups of users
- Host\_Alias — groups of hosts
- Runas\_Alias — groups of users to run as
- **Cmnd\_Alias** — groups of commands (this one)

### Basic Syntax

```bash
Cmnd_Alias  ALIAS_NAME = /full/path/to/command1, \
                       /full/path/to/command2 arg1 arg2, \
                       /full/path/to/command3
```

Rules:

- Alias name **must** start with a capital letter and can contain uppercase letters, numbers, and underscores (e.g., API\_SERVICE, SYSTEMCTL\_API).
- Always use **full absolute paths** to commands (never just systemctl).
- You can continue long lines with a backslash \\.
- You can include other Cmnd\_Alias names inside another one.

### Example for Your api.service (Recommended Version)

Create or edit the file with `sudo visudo -f /etc/sudoers.d/10-deploy-api`:

```bash
# Command alias for managing the api.service safely
Cmnd_Alias API_SERVICE_CMDS = /usr/bin/systemctl start api.service, \
                             /usr/bin/systemctl stop api.service, \
                             /usr/bin/systemctl restart api.service, \
                             /usr/bin/systemctl status api.service

# Grant the deploy user passwordless access to only these commands
deployuser ALL=(ALL) NOPASSWD: API_SERVICE_CMDS
```

This is cleaner than listing the four commands directly on the user line.

### More Flexible Example (Allow Any Action on the Specific Service)

If you want the deploy user to run **several** systemctl actions on api.service, do **not** use a wildcard such as `/usr/bin/systemctl * api.service`. In sudoers, wildcards in command arguments match any characters, including spaces, so that rule does not limit the user to api.service. It also matches, for example, `systemctl stop sshd.service api.service` or `systemctl edit api.service` (which opens an editor as root).

List each allowed command explicitly (as in the example above), or on sudo 1.9.10 and later (check with `sudo -V`) use a regular expression, which must start with `^` and end with `$`:

```bash
Cmnd_Alias API_SERVICE_CMDS = /usr/bin/systemctl ^(start|stop|restart|reload|status) api\.service$

deployuser ALL=(ALL) NOPASSWD: API_SERVICE_CMDS
```

This allows only the listed actions on api.service.

### How to Use It in Your Setup

- Create the file:

```bash
sudo visudo -f /etc/sudoers.d/10-deploy-api
```

- Paste the Cmnd\_Alias + user rule above.
- Set correct permissions:

```bash
sudo chmod 0440 /etc/sudoers.d/10-deploy-api
```

- Test it:

```bash
sudo -l -U deployuser
```

1. You should see the allowed commands listed for deployuser.

Then update your PowerShell script to use deployuser (instead of root).

### Why This Is Better Than the Original Line

Your original line:

```bash
deployuser ALL=(ALL) NOPASSWD: /usr/bin/systemctl stop api.service, /usr/bin/systemctl restart api.service, /usr/bin/systemctl status api.service
```

Works fine, but using Cmnd\_Alias is preferred when:

- You have more than 2–3 commands
- You might want to add more actions later
- You manage multiple services (you can create one alias per service)

#### Sources

- [https://www.sudo.ws/docs/man/sudoers.man/](https://www.sudo.ws/docs/man/sudoers.man/)