How to create a user, give them administrator rights, let them in with an SSH key, allow specific commands without a password, and lock and delete an account.
Contents
Your server already has an administrator account — ubuntu, debian, almalinux or freebsd (more details). If several people or a deployment program log in to the server, create a separate account for each: you can see who did what, and it is easy to take access away from one without affecting the others.
Creating a user
sudo useradd -m -s /bin/bash ivan
sudo passwd ivan-m creates the home directory /home/ivan, and -s sets the shell. The password is needed for sudo, even if the person will log in with a key.
On Ubuntu and Debian, sudo adduser ivan does the same thing, asking you questions step by step. On FreeBSD it is sudo adduser, also step by step.
Administrator rights
Administrators on Linux are members of a special group: sudo on Ubuntu and Debian, wheel on AlmaLinux. Add the user to it:
sudo usermod -aG sudo ivan # Ubuntu, Debian
sudo usermod -aG wheel ivan # AlmaLinuxDon’t leave out -a: without it, usermod -G replaces all of the user’s groups with just this one. The rights take effect the next time the user logs in. To check, log in as ivan and run sudo whoami — the answer should be root.
On FreeBSD, the wheel group only allows su; for sudo you also need a rule:
sudo pw groupmod wheel -m ivan
echo '%wheel ALL=(ALL) ALL' | sudo tee /usr/local/etc/sudoers.d/wheelLogging in with a key
Ask the person for their public key — a single line that starts with ssh-ed25519 — and put it in their directory:
sudo install -d -m 700 -o ivan -g ivan /home/ivan/.ssh
echo 'ssh-ed25519 AAAA… ivan@laptop' | sudo tee -a /home/ivan/.ssh/authorized_keys
sudo chown ivan:ivan /home/ivan/.ssh/authorized_keys
sudo chmod 600 /home/ivan/.ssh/authorized_keysThe permissions matter here: if the directory or file is writable by others, SSH won’t accept the key. To find out how to create a key and turn off password login, see How to connect to your server over SSH.
sudo without a password
For the account created along with the server, sudo doesn’t ask for a password. For new users it does, and that is how it should be: a stolen key without a password doesn’t give root rights.
If you do need it without a password — for a deployment program, for example — allow only the commands that are needed, not everything. Create the rules with visudo: it checks the file before saving it.
sudo visudo -f /etc/sudoers.d/deployThe line in the file:
deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myappsudo -i in it — you can correct the mistake from there. Write file names in /etc/sudoers.d/ without dots: sudo skips files with a dot in the name.Working as another user
sudo -i # root shell
sudo -iu ivan # shell as the user ivan
sudo -u www-data php script.php # a single command as www-dataTo go back to being yourself, type exit.
Who is on the server
getent passwd | awk -F: '$3 >= 1000 && $3 < 65000 {print $1}' # ordinary users
id ivan # which groups
who # who is on the server nowThe log shows who logged in over SSH, and when: Logs: journalctl and /var/log.
Locking or deleting an account
sudo usermod -L -e 1 ivan # lock: neither password nor key will work
sudo usermod -U -e '' ivan # unlock
sudo userdel -r ivan # delete, along with the home directoryBefore deleting, check whether any programs are running as that user (ps -u ivan) or any scheduled tasks (sudo crontab -l -u ivan).
On FreeBSD: sudo pw lock ivan locks the account, sudo pw unlock ivan unlocks it and sudo rmuser ivan deletes it.
Didn’t find the answer? Ask our support team — we’ll help.