How to create a sudo user on Linux

Logging in as root all the time is one of the most common beginner mistakes on a VPS. Root can delete anything, and a single mistyped command can destroy the server with no confirmation. The fix is a normal user account that can *temporarily* become root with sudo when needed.

Why sudo instead of root

• Safety: everyday commands run without root power, so accidents are contained.
• Accountability: sudo logs who ran what, which matters when more than one person has access.
• Habit: you type sudo deliberately for privileged actions instead of holding god-mode all day.

Step 1: Create the user

As root, create the account. This works on every major distro:

adduser deploy

You'll be prompted for a password and a few optional details. (On AlmaLinux/Rocky the interactive tool is useradd deploy && passwd deploy.)

Step 2: Grant sudo privileges

The group that grants sudo differs by distribution.

Ubuntu / Debian use the sudo group:

usermod -aG sudo deploy

AlmaLinux / Rocky / CentOS use the wheel group:

usermod -aG wheel deploy

The -aG flags mean "add to this group without removing the user from others." Forgetting the a can drop a user from all their other groups, so keep it.

Step 3: Verify the group membership

Check it took:

groups deploy

You should see sudo (or wheel) in the list.

Step 4: Test sudo as the new user

Switch to the new account and try a privileged command:

su - deploy
sudo whoami

Enter the user's password. If it prints root, sudo works. From now on you prefix admin commands with sudo:

sudo apt update
sudo systemctl restart nginx

Step 5: Log in as the user directly over SSH

You want to stop logging in as root entirely. First give the new user SSH key access from your local machine:

ssh-copy-id deploy@YOUR_SERVER_IP

Then confirm you can open a fresh session:

ssh deploy@YOUR_SERVER_IP

Once that works, you can safely disable root SSH login (covered in a separate guide) for a big security win.

Optional: passwordless sudo (use with care)

For automation you may want a user who doesn't get prompted for a password. Edit safely with visudo, which checks syntax before saving:

visudo

Add a line like:

deploy ALL=(ALL) NOPASSWD:ALL

Only do this on a server where you fully trust everyone with access — it removes the password speed-bump entirely.

Common pitfalls

• Locked out after disabling root: always verify the new user can log in *before* you turn off root SSH.
• User can't sudo: you probably added them to the wrong group for the distro — sudo on Debian family, wheel on RHEL family.
• Changes not applying: group membership refreshes on a new login, so log out and back in.

Wrapping up

A dedicated sudo user is step one of running any server responsibly. On a fresh Nxeon VPS — whichever one-click image you chose — this takes under a minute and immediately makes the box safer to work on. Do it before you install a single application.