Manage Linux users, groups and sudo access

Working as root all the time means one typo can wreck a server. Creating separate Linux users with sudo access gives each person their own login and audit trail, and lets you disable root SSH logins. This guide covers users, groups and sudo on Ubuntu, Debian, AlmaLinux and Rocky Linux.

Before you start

• Root SSH access to the VPS.
• A name for each person or service account.

Create a user

On Debian/Ubuntu, adduser is interactive and creates the home directory:

adduser deploy

On AlmaLinux/Rocky:

useradd -m -s /bin/bash deploy && passwd deploy

For a service account that should never log in, use useradd -r -s /usr/sbin/nologin appsvc.

Give the user sudo rights

Add the user to the admin group: sudo on Debian/Ubuntu, wheel on RHEL-based systems.

usermod -aG sudo deploy

usermod -aG wheel deploy

The -a is essential: without it, -G replaces all the user's other groups. The user must log out and back in for the change to apply. Test it:

su - deploy -c 'sudo whoami'

It should print root after the password prompt.

Fine-grained sudo rules

Always edit sudo rules with visudo, which checks syntax so a mistake cannot lock you out. Put custom rules in their own file:

visudo -f /etc/sudoers.d/deploy

Allow one user to restart a single service without a password:

deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp

Use full command paths, and avoid giving NOPASSWD: ALL to accounts that face the internet.

Manage groups

• Create a group: groupadd webteam
• Add a user: usermod -aG webteam alice
• Show a user's groups: id alice
• Remove a user from a group: gpasswd -d alice webteam

Combine groups with setgid directories so a team can share files: chgrp webteam /srv/project && chmod 2775 /srv/project.

Lock, expire or delete accounts

• Lock the password: usermod -L alice (SSH keys may still work; also set usermod -s /usr/sbin/nologin alice).
• Expire the account on a date: chage -E 2025-12-31 alice
• Delete the user and home directory: userdel -r alice (back up the home first if needed).

Check who has access

• Members of admin groups: getent group sudo wheel
• Accounts with a login shell: grep -vE 'nologin|false' /etc/passwd
• Recent logins: last -n 20 and failed ones with lastb
• Sudo use: journalctl _COMM=sudo

Troubleshooting

• user is not in the sudoers file: add the user to sudo/wheel as root, then log in again.
• Broken sudoers file: if sudo fails with a parse error, log in as root (or via console) and run visudo to fix it.
• New user cannot SSH in: copy an SSH key to /home/user/.ssh/authorized_keys with the right owner and permissions, and check AllowUsers in sshd_config.

Linux users FAQ

Should I disable root login?

Yes, once a sudo user with an SSH key works. Set PermitRootLogin no in sshd_config.

adduser or useradd?

adduser is a friendly Debian/Ubuntu wrapper. useradd is the low-level tool available everywhere.

Can I add users on cPanel hosting?

Not Linux users; each cPanel account is one system user. You can add FTP, email and sub-users in cPanel instead.

Next steps

• Set up SSH key authentication
• Linux file permissions explained
• SSH lockdown checklist