Debian 9: can’t use sudo

SUDO_USER is documented in man sudo (not sudoers):

SUDO_USER        Set to the login name of the user who invoked sudo.

That is, if you run sudo sh -c 'echo $SUDO_USER' it is a roundabout way of getting the effect of whoami.

sudo logs when a user runs (or tries to run) a command through it. You can list them with journalctl /usr/bin/sudo or something equivalent for your system. It lists the user name and command of each invocation.

If sudo is run 1) as root and 2) with SUDO_USER set, the log entry will be tagged with the SUDO_USER username, rather than as "root". This lets a (cooperating) user record the commands they ran for posterity, even though they were in an unrestricted environment. sudo always succeeds when run with root privileges (unless disabled with the root_sudo setting), since you could just run the command without it.

There are two main ways this would come up. The first is the obvious sudo bash or equivalent and a desire to record things. The other use case is for scripts, which can log the actual actions they took on behalf of users. It's an informative behaviour, not a security issue.

sudo -e is used for editing files and uses a different set of security policies, also documented in man sudo and somewhat safer editing behaviours. People sometimes use it when logged in as root for those features, and it has the same interaction with SUDO_USER as above.

The error message tells you what is wrong even if it doesn't tell you exactly how to fix it.

adminvpn is not in the sudoers file.

sudo lets you run commands as the administrator. In order to be able to use sudo, you need to be made an administrator. Accounts are not made administrators by default.

Run the command visudo (as root, of course) and add a line like the following:

adminvpn ALL=(ALL) ALL

Save the file and exit. You can now run any command as root with sudo.

Note that visudo will run your favorite editor, as indicated by the environment variable VISUAL. If you haven't configured that, you'll get vi. If you're uncomfortable with vi, install another editor (e.g. pkg_add nano) and add a line like export VISUAL=nano to ~/.profile; run the command in your interactive shell as well for it to take effect in the current session.

Unless configured otherwise, sudo requires you to type your own password. Knowledge of the root password is not necessary, that's the point of sudo`. The point of typing your password is to make sure it isn't someone else typing while you left your keyboard unattended.

By the way, OpenBSD isn't the most beginner-friendly unix out there. If you want a gentler learning curve, try Ubuntu.