Creating a Non-Root Sudo User on a Debian or Ubuntu VPS

A named sudo user separates normal work from administrative actions and avoids sharing one root login among operators. Create it from an existing authorized administrator session and verify access before changing root login settings.

Debian or Ubuntu example

From a root session, use:

adduser appadmin
usermod -aG sudo appadmin

If already logged in through a sudo-capable user, prefix administrative commands with sudo. Confirm that the sudo package and group configuration exist on the installed image; minimal images can differ.

Install the new user's own public SSH key with the correct file ownership and restricted permissions. Do not copy a private key onto the server. Do not assume root's authorized keys are automatically available to the new account.

Verify in another session

Connect through the assigned public NAT SSH port as appadmin. Run id and sudo -v, then try a harmless administrative command such as sudo whoami. It should report root when sudo authorization succeeds.

Group membership updates normally require a new login session. If verification fails, retain the original session and fix the account or policy rather than locking down the only working path.

Keep application processes separate

Use a dedicated nonprivileged service account for an application where practical. An account that deploys software does not need to run every application permanently as root. Review which directories and secrets each service can access.

See SSH key setup, first-login checks and systemd services.

Reference: Debian Administrator's Handbook.