How to create a non-root user with sudo on your VPS

A fresh VPS usually gives you one account: root. Root can do anything, including deleting the whole system with one mistyped command, and every attacker on the internet knows the name. The first thing most administrators do is create an ordinary account with permission to run admin commands through sudo, and then stop using root. It takes two minutes and removes a whole class of risk.

Why not just use root

• Attackers always try root. Automated scans try common passwords against it all day. A user with an unusual name is a harder target.
• Mistakes are final. As root, a typo in a rm command removes whatever it points at, with no confirmation. With sudo, you type a deliberate extra word before each risky command, which acts as a pause.
• Accountability. sudo records who ran what in the system log.

Step 1: connect

Log in as root once, using the details from your provider. If you have not connected before, Connect to your VPS over SSH shows how.

Step 2: create the user

On Ubuntu and Debian, run:

adduser alex

Replace alex with the name you want. It asks for a password, which should be long and unique, and a few optional details you can skip by pressing Enter. Use a password manager rather than inventing one you will reuse.

Step 3: give it sudo rights

usermod -aG sudo alex

This adds the user to the sudo group. On some other distributions, the group is called wheel instead. The -aG matters: without the a, the command replaces the user's groups instead of adding one.

Step 4: test before you trust it

This is the step people skip. Keep your root session open, and in a second terminal log in as the new user:

ssh alex@YOUR_SERVER_IP
sudo whoami

The second command should ask for the user's password and then print root. If it does, sudo works. If you get "alex is not in the sudoers file", the group step went wrong, so fix it from the root session.

Step 5: use sudo, not root

From now on, log in as the new user, and put sudo in front of commands that need power:

sudo apt update
sudo systemctl restart nginx

Avoid sudo su and sudo -i, which turn you back into root for the whole session and defeat the purpose.

Step 6: next steps

Creating the user is only the first move. To get the benefit, finish the job:

1. Set up SSH keys for the new user, which are much safer than passwords. See How to set up SSH key authentication.
2. Disable direct root login over SSH, and passwords if you can. See How to harden your SSH configuration.
3. Turn on a firewall. See Set up a firewall on your VPS with UFW.
4. Apply the rest of the checklist in Basic security for a new VPS.

Do these in order, and test each in a second session before closing the first.

Managing users later

Task	Command
See who is in which group	id alex
Remove sudo rights	deluser alex sudo
Change a password	sudo passwd alex
Delete a user and their files	sudo deluser --remove-home alex
List users with a login shell	grep -v nologin /etc/passwd

For a team, give each person their own account rather than sharing one. Then you can remove one person's access without disturbing everyone else, and logs show who did what.

Giving limited power

Not everyone needs full sudo. You can allow a user to run only certain commands by creating a file in /etc/sudoers.d/, edited with visudo, which checks the syntax before saving. A mistake in the sudoers file can lock everyone out of sudo, so always use visudo, never a plain editor.

Common problems

• "Permission denied" when running a command. You forgot sudo.
• sudo asks for a password you do not know. You set one in step 2, or reset it from the root session.
• You locked yourself out. Keep the root session open until the new user is proven, as in step 4. Most providers also offer a console in their dashboard as a way back in.

---

Still stuck? Open a ticket on Discord - run /ticket in any channel, pick a department, and include your Server ID or Invoice ID so we can jump straight in.