Security

Create a sudo user on Ubuntu, Debian, AlmaLinux and Rocky Linux

Add a personal admin account with sudo rights, give it your SSH key, and test it properly before you stop logging in as root.

BeginnerLinux server3 min read

Logging in as root for everyday work means every typo runs with full power. A personal user with sudo rights asks for confirmation before admin commands and leaves a clear record in the logs of what was run.

Replace alex in the commands below with the username you want.

1. Create the user

On Ubuntu and Debian, adduser asks for a password and optional details (press Enter to skip them):

Bash
adduser alex

On AlmaLinux and Rocky Linux, adduser does not prompt, so set the password separately:

Bash
adduser alex
passwd alex

2. Grant sudo rights

Ubuntu and Debian use the sudo group:

Bash
usermod -aG sudo alex

AlmaLinux and Rocky Linux use the wheel group:

Bash
usermod -aG wheel alex

Check the result with groups alex.

3. Copy your SSH key to the new user

If you already log in as root with an SSH key, copy it across with the right owner and permissions:

Bash
rsync --archive --chown=alex:alex ~/.ssh /home/alex

No key yet? Follow Set up SSH keys and add the key for alex instead of root.

4. Test before you log out

Warning: Keep your root session open until the new user is fully tested. Closing it too early is the most common way to get locked out.

Open a second terminal on your computer and run:

Bash
ssh alex@203.0.113.25
sudo whoami

sudo asks for alex's password (not root's), then prints root. If it does, the account is ready.

Run admin commands as your user

Put sudo in front of any command that needs root:

Bash
sudo apt update
sudo systemctl restart nginx

For a longer admin session, sudo -i opens a root shell. Type exit to leave it.

Passwordless sudo: think twice

You can let a user run sudo without a password, but if that account's key is ever stolen, the attacker gets root instantly. If you need it for automation, give it to a dedicated user and limit it with a rule edited through visudo, which checks the syntax before saving:

Bash
sudo visudo -f /etc/sudoers.d/deploy
deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp

Troubleshooting

  • "alex is not in the sudoers file": the group change did not apply. Re-run step 2, then log out and back in, because group membership is read at login.
  • Permission denied (publickey): check that /home/alex/.ssh is owned by alex, the folder is 700 and authorized_keys is 600.
  • Locked out: use the browser console from Open Control Panel on your service page and log in as root there.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AIOpen a ticket

Related guides

Security

Set up a UFW firewall on Ubuntu and Debian

Set safe defaults, allow SSH before switching UFW on, open only the ports you use, limit sensitive ports to your own IP, and tidy up old rules.

3 min read
Security

Make iptables rules survive a reboot

iptables rules live in memory and disappear on reboot. Save them with netfilter-persistent on Debian and Ubuntu or iptables-services on AlmaLinux and Rocky Linux.

5 min read