Running your Ubuntu server as the root user is risky. One wrong command can break everything. That is why smart server owners create a non-root sudo user for daily work. This guide shows you how to set up a non-root sudo user on Ubuntu server in just a few minutes. No fancy tools needed. No confusing steps. Just clear, simple commands that work on Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
By the end of this tutorial, you will have a safe user account with sudo privileges. You will be able to run admin commands without logging in as root. Your server will be more secure, and you will have peace of mind.
Quick Answer: Non-Root Sudo User Setup in 3 Commands
The TL;DR Commands
If you just want the commands and nothing else, here they are. Run these three commands as root on your Ubuntu server:
| Step | Command | What It Does |
|---|---|---|
| 1 | adduser myuser | Creates a new user account |
| 2 | usermod -aG sudo myuser | Gives the user sudo privileges |
| 3 | su – myuser | Switches to the new user |
Replace “myuser” with the username you want. That is the whole non-root sudo user setup in its simplest form. Read on to understand what each command does and how to do it properly.
What You’ll Accomplish
After completing this sudo user setup guide, you will have:
- A new user account on your Ubuntu server
- Sudo privileges for that user account
- The ability to run admin commands safely
- A more secure server setup
- Knowledge to troubleshoot common issues
Prerequisites Before Creating Your Sudo User on Ubuntu
Server Access Requirements
Before you start the non-root sudo user setup, you need a few things ready. First, you need access to an Ubuntu server. This can be a physical machine, a virtual private server, or a cloud instance from providers like AWS, DigitalOcean, or Linode.
You also need root access or an existing admin account. If this is a fresh server, your cloud provider usually gives you root login details by email. Keep those details safe.
Ubuntu Version Compatibility (24.04 LTS & 26.04 LTS)
This guide works on Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. The commands also work on older versions like 22.04 LTS and 20.04 LTS. The sudo user setup process has stayed the same for many years. So even if you run a slightly different version, these steps will work.
Tools You’ll Need
To create a sudo user on Ubuntu, you need:
- A terminal or SSH client like PuTTY (Windows) or Terminal (Mac/Linux)
- Your server IP address
- The root password or SSH key
- About 5 minutes of time
No special software is needed. The adduser and usermod commands come built into every Ubuntu server.
Step 1: Log Into Your Ubuntu Server as Root
SSH Connection Methods
The most common way to access your Ubuntu server is through SSH. Open your terminal and type this command:
ssh root@your_server_ip
Replace “your_server_ip” with the actual IP address of your server. For example, if your server IP is 192.168.1.100, you would type:
ssh root@192.168.1.100
Press Enter. If this is your first time connecting, you will see a message asking if you trust this server. Type “yes” and press Enter. Then enter your root password when asked. You will not see the password characters as you type. That is normal. Just type the password and press Enter.
Using the Console (Cloud Providers)
If SSH is not working, most cloud providers offer a web console. Log into your cloud provider dashboard. Find your server instance. Look for a button that says “Console” or “VNC” or “Web Terminal”. Click it. You will see a login screen. Type “root” as the username and enter your password.
Verifying Root Access
Once logged in, make sure you are really root. Type this command:
whoami
Press Enter. If the output says “root”, you are in the right place. You can also type:
id
This shows your user ID. Root has UID 0. If you see “uid=0(root)”, you have full admin access. Now you are ready to create a non-root sudo user on your Ubuntu server.
Step 2: Create a New Non-Root User Account
Using the adduser Command (Interactive Method)
The easiest way to create a new user on Ubuntu is with the adduser command. This command asks you questions one by one. It sets up the home folder, copies default files, and asks for a password.
Type this command:
adduser myuser
Replace “myuser” with the username you want to create. Pick a short, simple name. Good choices: “admin”, “deploy”, “webmaster”, or your own name. Avoid spaces or special characters.
After you press Enter, the system asks you to set a password. Type a strong password. A strong password has at least 12 characters, mixes upper and lower case letters, includes numbers, and has special symbols. Type the password twice to confirm.
Then the system asks for optional info like full name, room number, and phone. You can just press Enter to skip each field. At the end, it asks “Is the information correct?” Type “Y” and press Enter.
Your new user account is now created. But this user does not have sudo privileges yet. That is the next step.
Non-Interactive User Creation for Automation
If you want to create a user without answering questions, use the useradd command instead. This is useful for scripts and automation:
useradd -m -s /bin/bash myuser
The -m flag creates a home directory. The -s flag sets the default shell to bash. Then set a password with:
passwd myuser
Type the new password twice. This method is faster but gives you less default setup than adduser.
Understanding User Home Directory Structure
When you create a user, Ubuntu makes a home folder at /home/myuser. This folder holds the user’s personal files, settings, and documents. Think of it like the user’s own room in the server house.
Inside the home folder, you will find hidden files like .bashrc and .profile. These files control how the terminal looks and behaves for that user. You do not need to change them right now. Just know they are there.
Step 3: Grant Sudo Privileges to Your New User
Method 1: Adding User to the Sudo Group (Recommended)
On Ubuntu, the easiest way to give someone sudo privileges is to add them to the sudo group. Users in this group can run admin commands by typing “sudo” before the command.
Type this command:
usermod -aG sudo myuser
Let us break this down. “usermod” means “modify user”. The “-a” flag means “append” or “add”. The “-G” flag means “add to a group”. And “sudo” is the group name. So this command adds myuser to the sudo group.
This is the recommended method for sudo user setup because it is simple and safe. The sudo group already has the right permissions configured. You do not need to edit any config files.
Method 2: Editing the Sudoers File Directly
Another way to grant sudo privileges is to edit the sudoers file. This file controls who can use sudo and what they can do. To edit it safely, use the visudo command:
visudo
This opens the file in a text editor. Scroll to the bottom and add this line:
myuser ALL=(ALL:ALL) ALL
This line says: user myuser can run all commands on all hosts as any user. Save the file and exit. In the nano editor, press Ctrl+O to save, then Ctrl+X to exit.
Warning: Never edit the sudoers file with a regular text editor like nano or vim directly. Always use visudo. If you make a typo in the sudoers file, you could lock yourself out of sudo access completely.
Verifying Group Membership
To check that your user is now in the sudo group, type:
groups myuser
You should see output like: “myuser : myuser sudo”. This means the user belongs to their own group and the sudo group. If you see “sudo” in the list, the sudo user setup is working correctly.
Step 4: Test and Verify Sudo Access Works
Switching to the New User
Now it is time to test your new non-root sudo user. Switch to the new account by typing:
su – myuser
The dash is important. It loads the user’s full environment. You will see the prompt change. It might now show “myuser@servername” instead of “root@servername”.
Running sudo whoami Test
To test if sudo works, type:
sudo whoami
The first time you run sudo, it asks for your password. Type the password you set for myuser. Then it should print “root”. This means your command ran as root, even though you are logged in as myuser. The sudo user setup is working.
Testing SSH Login as Non-Root User
Open a new terminal window. Try to log in directly as your new user:
ssh myuser@your_server_ip
Enter your password when asked. If you can log in and run sudo commands, your non-root sudo user on Ubuntu server is fully set up and working.
Common Verification Commands
Here are some commands to double-check your setup:
| Command | Purpose |
|---|---|
| sudo whoami | Should print “root” |
| sudo -l | Lists what commands you can run with sudo |
| id | Shows your user ID and group memberships |
| groups | Lists all groups you belong to |
Advanced: Customizing Sudo Permissions for Non-Root Users
Setting Up Passwordless Sudo (NOPASSWD)
By default, sudo asks for your password every time. If you want to skip the password, you can set up NOPASSWD. Edit the sudoers file with visudo and add this line:
myuser ALL=(ALL) NOPASSWD: ALL
This lets myuser run any sudo command without typing a password. It is convenient but less secure. Only use this on servers you fully control and trust.
Restricting Sudo to Specific Commands Only
Maybe you want a user to only restart services, not do everything. You can limit sudo to specific commands. Add this line to the sudoers file:
myuser ALL=(ALL) /usr/bin/systemctl restart nginx, /usr/bin/systemctl restart apache2
Now myuser can only restart nginx and apache2 with sudo. Any other sudo command will be denied. This is great for giving limited access to team members.
Creating Custom Sudo Rules in /etc/sudoers.d/
Instead of editing the main sudoers file, you can create separate files in /etc/sudoers.d/. This keeps things organized. To create a rule file:
sudo visudo -f /etc/sudoers.d/myuser-rules
Add your rules in this file. For example:
myuser ALL=(ALL) NOPASSWD: /usr/bin/apt update, /usr/bin/apt upgrade
This file is easier to manage than the main sudoers file. You can delete it to remove all rules for that user.
Managing Multiple Users with Different Privilege Levels
You can create groups for different access levels. For example, create a “webadmins” group and give that group sudo access to web-related commands only. Then add users to that group. This scales well when you have many users on your Ubuntu server.
Security Best Practices After Sudo User Setup
Disabling Root SSH Login
Once your non-root sudo user is working, disable root SSH login. Edit the SSH config file:
sudo nano /etc/ssh/sshd_config
Find the line that says “PermitRootLogin” and change it to:
PermitRootLogin no
Save the file and restart SSH with: sudo systemctl restart ssh. Now nobody can log in as root over SSH. They must use your sudo user account first.
Setting Up SSH Key Authentication
Passwords can be guessed. SSH keys are much safer. To set up key-based login, generate a key pair on your local computer:
ssh-keygen -t ed25519
Then copy the public key to your server:
ssh-copy-id myuser@your_server_ip
Now you can log in without a password, and it is more secure than password login.
Configuring Sudo Logging and Auditing
Every sudo command is logged in /var/log/auth.log. You can check this file to see who ran what commands. To make logging even better, add this to your sudoers file:
Defaults logfile=”/var/log/sudo.log”
This creates a separate log just for sudo commands. It helps you track changes and spot problems.
Implementing Two-Factor Authentication for Sudo
For extra security, you can add two-factor authentication to sudo. This means users need both a password and a code from their phone. Install the Google Authenticator PAM module and configure it in the sudo PAM settings. This step is advanced but very effective at stopping unauthorized access.
Troubleshooting Common Sudo User Issues
“User is Not in the Sudoers File” Error
If you see “myuser is not in the sudoers file. This incident will be reported”, it means the user does not have sudo privileges. Go back to Step 3 and run the usermod command again. Make sure you type the username correctly. Check with “groups myuser” to confirm the user is in the sudo group.
Locked Out of Server After User Creation
If you disabled root login but your new user does not work, you might be locked out. Most cloud providers have a web console. Use it to log in as root. Then fix the user account or re-enable root login temporarily. Always test your new sudo user before disabling root access.
Sudo Password Not Working
If sudo asks for a password but yours does not work, remember: sudo asks for YOUR password, not the root password. Type the password you set for myuser. If you forgot it, log in as root and reset it with: passwd myuser
Permission Denied When Running Sudo Commands
If you get “permission denied” even though you are in the sudo group, check the sudoers file. Maybe someone added a rule that blocks your user. Run “sudo -l” to see what you are allowed to do. If the output is empty or shows restrictions, edit the sudoers file to fix it.
FAQ: Non-Root Sudo User Setup on Ubuntu Server
What’s the Difference Between Root and Sudo User?
Root is the super admin. It can do anything without asking permission. A sudo user is a regular user with special powers. When a sudo user needs to do admin work, they type “sudo” and enter their password. This creates a log of what they did. Root does not create such logs. That is why sudo users are safer for daily work.
Can I Have Multiple Sudo Users on Ubuntu?
Yes. You can create as many sudo users as you want. Just repeat the sudo user setup steps for each person. Each user gets their own account, password, and home folder. All of them can run sudo commands. This is great for teams working on the same server.
How Do I Remove Sudo Privileges From a User?
To take away sudo access, remove the user from the sudo group. Log in as root or another sudo user and type:
deluser myuser sudo
Or on some systems:
gpasswd -d myuser sudo
The user can still log in but can no longer run admin commands. Their files and account remain untouched.
Is It Safe to Use NOPASSWD for Sudo?
It depends. NOPASSWD is convenient but risky. If someone steals your session or leaves your terminal unlocked, they can run any admin command without a password. For personal servers, NOPASSWD is usually fine. For shared or production servers, require a password. It adds a small delay but much more safety.
What Happens If I Delete the Only Sudo User?
If you delete the only sudo user and root login is disabled, you lose admin access. You cannot install software, change settings, or fix problems. Always make sure you have at least one working sudo user before deleting another. Test the new user first. Then remove the old one.
Conclusion and Next Steps for Server Security
You have now learned how to set up a non-root sudo user on Ubuntu server. This is one of the most important security steps you can take. By using a sudo user instead of root, you reduce the risk of accidental damage and make your server harder to attack.
Here is a quick summary of what you did:
- Logged into your Ubuntu server as root
- Created a new user account with adduser
- Added the user to the sudo group with usermod
- Tested sudo access to confirm it works
Your next steps should include:
- Disabling root SSH login
- Setting up SSH key authentication
- Configuring a firewall with UFW
- Keeping your server updated with security patches
- Setting up automatic backups
Server security is a journey, not a destination. Each step you take makes your server safer. The non-root sudo user setup you just completed is a big step in the right direction. Keep learning, keep improving, and your server will stay safe and strong.