User Management

Prerequisites:

Linux server with root/sudo access
SSH or console access to your server

Creating a personal user account with sudo privileges is a critical first step in securing your Linux server. This allows you to disable root login while maintaining administrative access through your personal account.

Why Create a Personal User?

Security

Disabling root login prevents attackers from directly accessing the root account, even if they obtain credentials.

Accountability

Using personal accounts makes it easier to track who performed what actions on the system.

Best Practice

Industry standard security practice recommended by security experts and compliance frameworks.

Flexibility

Multiple users can have sudo access, allowing for better access management.

Creating a Personal User

Important: Create your personal user account and verify sudo access BEFORE disabling root login. Otherwise, you may lock yourself out of your server.

Create a new user

Create a new user account (replace username with your desired username):

sudo adduser username

You’ll be prompted to:

Set a password (choose a strong password)
Provide optional user information (full name, room number, work phone, etc.)
Confirm the information

You can also use useradd instead of adduser, but adduser is more interactive and user-friendly on Debian/Ubuntu systems.

Add user to sudo group

Grant sudo privileges to the new user:

sudo usermod -aG sudo username

This adds the user to the sudo group, which allows them to execute commands with administrative privileges.

On some systems (like RHEL/CentOS), the group might be called wheel instead of sudo. Use: sudo usermod -aG wheel username

Verify user creation

Switch to the new user and verify sudo access:

su - username
sudo whoami

If successful, sudo whoami should return root. This confirms that:

The user account was created successfully
The user has sudo privileges
You can execute administrative commands

Test sudo access

Try running a command that requires sudo:

sudo apt update
# or on RHEL/CentOS
sudo yum update

You’ll be prompted for your user’s password (not root’s password). If the command executes successfully, your sudo access is working correctly.

Alternative: Create User with Sudo in One Command

You can create a user and add them to the sudo group in a single command:

sudo adduser --ingroup sudo username

Or using useradd:

sudo useradd -m -s /bin/bash -G sudo username
sudo passwd username

Managing User Accounts

Change user password

Change a user’s password:

sudo passwd username

You’ll be prompted to enter the new password twice.

Remove sudo privileges

Remove a user from the sudo group:

sudo deluser username sudo
# or on some systems
sudo gpasswd -d username sudo

Add user to additional groups

Add a user to additional groups:

sudo usermod -aG group1,group2 username

Common groups:

sudo or wheel - Administrative privileges
docker - Docker access
www-data - Web server access

Delete a user account

Delete a user account:

# Delete user but keep home directory
sudo deluser username

# Delete user and home directory
sudo deluser --remove-home username

Be careful when deleting user accounts. Make sure you have backups of important data.

List all users

View all users on the system:

# List all users
cat /etc/passwd | cut -d: -f1

# List users with sudo access
getent group sudo | cut -d: -f4

View user information

Get detailed information about a user:

# View user details
id username

# View groups user belongs to
groups username

# View user's home directory
echo ~username

Sudo Configuration

Understanding Sudo

Sudo (Super User Do) allows users to run commands with the privileges of another user, typically root. Users in the sudo group can execute administrative commands by prefixing them with sudo.

Sudo Configuration File

The sudo configuration is located at /etc/sudoers. Never edit this file directly! Always use visudo:

sudo visudo

Syntax errors in /etc/sudoers can lock you out of sudo access. Always use visudo which validates syntax before saving.

Common Sudo Configurations

Allow sudo without password

Allow specific users to use sudo without entering a password:

sudo visudo

Add this line (replace username):

username ALL=(ALL) NOPASSWD: ALL

This reduces security. Only use for trusted users or specific use cases.

Restrict sudo to specific commands

Allow a user to run only specific commands with sudo:

username ALL=(ALL) /usr/bin/apt, /usr/bin/systemctl

This allows the user to only run apt and systemctl with sudo.

Sudo timeout

By default, sudo remembers your password for 15 minutes. To change this:

Defaults timestamp_timeout=30

Set to 0 to require password every time, or a number for minutes.

Security Best Practices

Strong Passwords

Use strong, unique passwords for all user accounts. Consider using a password manager.

Limit Sudo Access

Only grant sudo access to users who need it. Regularly review who has sudo privileges.

Regular Audits

Periodically review user accounts and remove unused or unnecessary accounts.

SSH Keys

After creating your user, set up SSH key authentication instead of passwords. See our SSH Security guide.

Next Steps

After creating your personal user account:

Set up SSH keys - Configure key-based authentication for your new user. See SSH Security.
Disable root login - Once you’ve verified your user account works, disable root SSH access.
Configure firewall - Set up UFW to protect your server. See Firewall Configuration.

Troubleshooting

User can't use sudo

Verify the user is in the sudo group:

groups username

If not, add them:

sudo usermod -aG sudo username

The user may need to log out and back in for changes to take effect.

Permission denied errors

Check:

User is in sudo group: groups username
Sudoers file syntax: sudo visudo -c
User is using sudo prefix: sudo command

Can't switch to new user

If su - username fails:

Verify user exists: id username
Check if account is locked: sudo passwd -S username
Ensure user has a valid shell: cat /etc/passwd | grep username

Remember: Always test your user account thoroughly before disabling root login. Keep a root session open as a backup until you’re confident everything works.

Guides

Securing Linux

Why Create a Personal User?

Security

Accountability

Best Practice

Flexibility

Creating a Personal User

Alternative: Create User with Sudo in One Command

Managing User Accounts

Sudo Configuration

Understanding Sudo

Sudo Configuration File

Common Sudo Configurations

Security Best Practices

Strong Passwords

Limit Sudo Access

Regular Audits

SSH Keys

Next Steps

Troubleshooting

​Why Create a Personal User?

Security

Accountability

Best Practice

Flexibility

​Creating a Personal User

​Alternative: Create User with Sudo in One Command

​Managing User Accounts

​Sudo Configuration

​Understanding Sudo

​Sudo Configuration File

​Common Sudo Configurations

​Security Best Practices

Strong Passwords

Limit Sudo Access

Regular Audits

SSH Keys

​Next Steps

​Troubleshooting

Why Create a Personal User?

Creating a Personal User

Alternative: Create User with Sudo in One Command

Managing User Accounts

Sudo Configuration

Understanding Sudo

Sudo Configuration File

Common Sudo Configurations

Security Best Practices

Next Steps

Troubleshooting