forester, I think your missing out on the
%sudo ALL=(ALL:ALL) ALL
line.
as knoppix is a member of the sudo group it can still do all commands but you need to enter a password.
so it's essentially the same as
knoppix ALL=PASSWD: ALL
at least it's behaving that way

It could be that I'm making a mistake here because to be honest, I don't understand the sudoers file syntax.