How to Create a User with Sudo on Ubuntu Server (and Why You Shouldn't Use Root)
Every Linux server has a superuser called root that can do anything — including deleting the whole system with one typo. Day to day you should log in as a normal user and use sudo to borrow root's powers only for the commands that need them. Here's how to create that user, give them sudo, and tidy up accounts you don't need.
Quick reference
| Task | Command |
|---|---|
| Add a user | sudo adduser sarah |
| Give them admin rights | sudo usermod -aG sudo sarah |
| Switch to them | su - sarah |
| Remove a user and their files | sudo deluser --remove-home sarah |
| See who has sudo | getent group sudo |
1. Add the user
sudo adduser sarah
It asks for a password (twice) and some optional details — just press Enter through the name and phone number questions. The user gets a home folder at /home/sarah.
2. Give them sudo
sudo usermod -aG sudo sarah
-aG means append to group. Forget the a and you'd replace all their groups with just sudo, which causes odd problems later.
3. Test it
su - sarah
sudo whoami
Type Sarah's password when asked. If it prints root, the new user can use sudo. Type exit to go back to your own account.
What sudo actually does
Put sudo in front of a command and it runs as root, after checking your password. Ubuntu remembers the password for 15 minutes so you aren't asked for every command. Things that need sudo include installing software, editing files in /etc, and restarting services. Things that don't: reading your own files, checking disk space, looking at logs you have permission to see.
If you get "Permission denied" on a command, that's usually the hint to add sudo. To re-run the last command with sudo, type:
sudo !!
Should you ever log in as root?
On Ubuntu the root account has no password and can't log in directly, which is deliberate. On cloud servers (DigitalOcean, Hetzner and so on) you often are given a root login to start with. First job: create your own user as above, copy your SSH key to it, and then stop using root.
Removing a user
sudo deluser --remove-home oldname
Leave off --remove-home to keep their files. If they had sudo, that goes with the account.
Changing a password
Your own: passwd. Someone else's: sudo passwd sarah.
Troubleshooting
"sarah is not in the sudoers file." The usermod command didn't run, or the user hasn't logged out and in again since. Groups are read at login.
Adding a user on a cloud server with no password. Use sudo adduser --disabled-password sarah, then copy an SSH key into /home/sarah/.ssh/authorized_keys and make sure the folder is owned by them: sudo chown -R sarah:sarah /home/sarah/.ssh.
You locked yourself out of sudo. Log in at the server's keyboard, boot to recovery mode (tutorial 37 in this series) and add yourself back to the group.
Wrapping up
A normal user plus sudo gives you all the power of root with a safety net: a password check and a log entry every time you use it. Create one for every person who needs access, and never share a login.
