How to stop working as root: make a sudo user on Ubuntu or Debian

Do you already have one?

Many cloud servers log you in as a normal user, for example ubuntu on Ubuntu images. Check:

whoami
groups

If whoami doesn't say root and groups lists sudo, you already have a sudo user. Skip to step 5.

1. Create the user

Logged in as root, pick a name (we use alice) and run:

adduser alice

It asks for a password. Choose a long one and store it in your password manager. You won't use it to log in (your SSH key does that), but sudo asks for it. You can press Enter for the other questions.

2. Give it sudo rights

usermod -aG sudo alice

On Debian, if you set a root password during install, sudo may not be installed. If you get command not found later, run apt install sudo as root.

3. Copy your SSH key to the new user

This copies the keys root already accepts, with the right owner and permissions:

install -d -m 700 -o alice -g alice /home/alice/.ssh
install -m 600 -o alice -g alice /root/.ssh/authorized_keys /home/alice/.ssh/authorized_keys

No SSH key yet? Follow our SSH keys guide first.

4. Test in a new window

Leave the root session open. In a new terminal on your own computer:

ssh alice@your-server
sudo whoami

Type alice's password when sudo asks. If it prints root, it works. Do the rest of this guide as alice.

5. Turn off root login over SSH

Now nobody needs to log in as root directly. Create a settings file whose name sorts first, because the first value SSH finds wins:

sudo nano /etc/ssh/sshd_config.d/00-no-root.conf

Put this one line in it and save:

PermitRootLogin no

If you followed our SSH keys guide, this line is already in 00-keys-only.conf and you can skip this file. Check the settings, then restart SSH:

sudo sshd -t
sudo sshd -T | grep -i permitrootlogin
sudo systemctl restart ssh

sshd -t prints nothing when the settings are fine, and the second command should say permitrootlogin no. From a new window, ssh root@your-server should now say Permission denied, and ssh alice@your-server should still work.

Everyday use

• One command as root: put sudo in front, for example sudo apt upgrade or sudo nano /etc/nginx/nginx.conf. Sudo remembers your password for a few minutes.
• Many commands in a row: sudo -i opens a root shell. Type exit as soon as you're done.
• See what was run with sudo: sudo journalctl -t sudo | grep COMMAND shows who ran what, and when. Our guide to seeing who logged in and what they ran covers more.
• One user per person. If someone else helps with the server, give them their own user and key. When they leave, remove their user: sudo userdel -r bob.

What not to do

• Don't turn off the sudo password (NOPASSWD: ALL) for your daily user. Then anyone with your SSH key is root right away.
• Don't run websites as this user. Your sudo user is for you. Each website should run as its own user without sudo. See one user and PHP-FPM pool per site.
• Don't edit /etc/sudoers directly. A mistake there can break sudo. If you ever need to change it, use sudo visudo, which checks the file before saving.

If you get locked out

Use your hosting provider's web console (sometimes called VNC, rescue or serial console). Log in as root there, then delete /etc/ssh/sshd_config.d/00-no-root.conf and run systemctl restart ssh, or fix alice's .ssh folder.

Official sources

• adduser manual page (Debian)
• sudo on the Debian wiki
• User management (Ubuntu Server docs)
• sudo manual (sudo project)
• sshd_config manual (OpenSSH)

Next steps: turn on a firewall, then work through the rest of the security checklist for a new PHP server.

ServerNest works the same way: its small helper on your server has root rights, but it only accepts a fixed list of safe actions, never any command typed in a dashboard. It is also being built to run each website as its own Linux user. Join early access to try it first.

← Back to the security blog