Creating a user and granting sudo privileges on Linux

With the root user, all operations run without restriction, so a mistyped command or a compromised password can cause serious damage (see: Root access: what does it mean and what responsibilities does it entail?). It is therefore recommended to work with a dedicated user account and to elevate privileges using sudo on a command-by-command basis only for system administration tasks.

Please carry out the following steps as the root user. In the examples, the username is janos; please replace this with your own.

1. Creating a user

AlmaLinux, Rocky Linux:

useradd -m janos
passwd janos

The -m command creates the user’s home directory (/home/janos), whilst the passwd command prompts for the new password.

Ubuntu, Debian:

adduser janos

The adduser command also creates the directory and immediately prompts you for a password, as well as some optional details (name, telephone number), which you can skip by pressing Enter.

2. Granting sudo privileges

Sudo privileges can be granted by adding the user to the appropriate group. The name of the group varies depending on the distribution:

# AlmaLinux, Rocky Linux
usermod -aG wheel janos

# Ubuntu, Debian
usermod -aG sudo janos

The -a suffix is important: without it, the user would be removed from all their other groups.

If the sudo command is not found on Debian, please install it first (see: Ubuntu/Debian – Fixing the “sudo: command not found” error).

3. Verification

Switch to the new user and try running ‘sudo’:

su - janos
sudo whoami

When you enter the first sudo command, the system will prompt you for your own password (not the root password). If the output is root, the configuration is working. You can return to the root user by entering the exit command.

4. Copying the SSH key

If you log in as the root user using an SSH key, you must also set up the key for the new user. The easiest way to do this is to copy it from your own machine using the ssh-copy-id command:

ssh-copy-id janos@vps.ip.cime

If password-based login is not enabled on the server, copy the root user’s keys to the server whilst logged in as the root user:

mkdir -p /home/janos/.ssh
cp /root/.ssh/authorized_keys /home/janos/.ssh/
chown -R janos:janos /home/janos/.ssh
chmod 700 /home/janos/.ssh
chmod 600 /home/janos/.ssh/authorized_keys

Permissions are important: if the .ssh directory or the authorized_keys file can be written to by others, the SSH server will ignore the key. For more information on permissions, see: File permissions (chmod, chown) on Linux.

Please try logging in in a new terminal window:

ssh janos@vps.ip.cime

If you can log in with the new user and sudo is working, you can disable SSH login for the root user. The steps for doing this are described in the article on SSH server security settings.

Whilst making the changes, leave the existing SSH connection open and only close it once you have successfully logged in with the new user in a new window. This way, you can revert the settings in the event of an error.

Other useful commands

# A felhasználó csoportjai
id janos

# Jelszó módosítása
sudo passwd janos

# Felhasználó zárolása (nem tud belépni), majd feloldása
sudo usermod -L janos
sudo usermod -U janos

# Felhasználó törlése a saját könyvtárával együtt
sudo userdel -r janos

Editing sudo settings

The sudo settings are contained in the /etc/sudoers file and the /etc/sudoers.d/ directory. You should always edit these using the visudo command, as it checks the syntax before saving; a faulty sudoers file would prevent anyone from using sudo-t. The sudo options, logging and common pitfalls are explained in the article ‘Using the sudo command with examples’.

sudo visudo -f /etc/sudoers.d/janos

For example, if a user can only restart one service without a password:

janos ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx

Do not set the NOPASSWD option for ALL commands, as if a user’s account or SSH key falls into the wrong hands, the entire server will be compromised.