Create a Linux user with sudo access

Before you start

Use this guide on Ubuntu 24.04 LTS or AlmaLinux 9 while signed in as root or an existing sudo administrator. Keep that session open until the new account can both connect and run sudo. Choose a simple account name; these examples use deploy. Replace that name consistently if you prefer another.

A separate account gives your daily shell its own home directory and normal user permissions. Sudo grants administrative privileges for individual commands. Give this access only to someone you trust to administer the entire VPS.

whoami
cat /etc/os-release

Create the account

On Ubuntu, adduser walks you through a password and optional profile details. On AlmaLinux, create the home directory explicitly and then set a password. Enter a unique password; the terminal does not display characters while you type. If AlmaLinux lacks sudo, install it with dnf install sudo from your existing root session.

sudo adduser deploy

sudo useradd -m -s /bin/bash deploy
sudo passwd deploy

Grant administrator membership

Ubuntu uses the sudo group. AlmaLinux uses wheel. The -a option appends the new group instead of replacing existing supplementary memberships. Group changes apply to a newly opened login session.

AlmaLinux normally authorizes wheel through sudoers. If sudo reports that access is denied, inspect the policy using visudo from the original administrator session. Do not edit sudoers with a plain text editor or add a passwordless rule as a shortcut.

sudo usermod -aG sudo deploy

sudo usermod -aG wheel deploy

id deploy

Test from a second connection

Open another terminal on your computer. Replace YOUR_PORT with the actual SSH port and YOUR_SERVER with the VPS address. The default is 22; if your server uses a different SSH port, use that configured port. A new password does not enable password authentication if the server already accepts only keys; install your public key for deploy first in that case.

Inside the new connection, sudo -k clears any cached authentication. Sudo should request deploy's password and id -u should print 0 when run through sudo.

ssh -p YOUR_PORT deploy@YOUR_SERVER

id
sudo -k
sudo -v
sudo id -u

uid=1001(deploy) gid=1001(deploy) groups=1001(deploy),27(sudo),100(users)
User deploy may run the following commands on glws-validate-ubuntu:
    (ALL : ALL) ALL
Administrator membership and sudo verified

Use the account day to day

Run ordinary file and application work as deploy and prefix only administrative commands with sudo. After testing, you can close the original connection. Keep a recovery console available before making separate SSH login-policy changes; this guide does not require disabling the root account.

sudo -l