Add a Sudo User in Ubuntu

What a sudo user is on Ubuntu

A sudo user on Ubuntu is an ordinary account that may run a single command as root by putting sudo in front of it, because the account belongs to the sudo group. The account keeps its own password, home folder and shell, and root keeps no shared login.

• Root is the superuser account. It can do anything and asks for no permission check.
• sudo runs one command as root, asks for the user's own password, and logs the action.
• The sudo group is the switch: /etc/sudoers already grants its members full sudo rights.

The sequence below creates the account, adds the group, and proves the login works before you close the session you are already using. That order is what keeps you out of a lockout on a remote server.

Create the account with adduser

Work from a session that already has root or sudo rights. If you are on the machine's console as root, skip the first step.

1. Connect as the existing admin: ssh root@your-server-ip, or ssh in as your own sudo user.
2. Create the account: adduser priya, replacing priya with the name you want.
3. Type the new password twice. adduser shows nothing as you type, which is normal.
4. Press Enter through Full Name, Room Number, Work Phone and Home Phone. They are optional.
5. Answer Y to the confirmation, then check the account exists with id priya.

You know it worked when id priya prints a uid, a gid and a group list, and ls /home shows a folder for the new account. A message that the user already exists means the name is taken; pick another one.

Give the account sudo with usermod -aG sudo

One command adds the group. The two flags matter more than the command itself.

1. Run usermod -aG sudo priya.
2. Read the flags: -G sets supplementary groups and -a appends to them instead of replacing them.
3. Confirm with groups priya. The output should end with sudo.

You know it worked when groups priya lists sudo. Leaving out -a is the classic mistake: usermod -G sudo priya strips every other supplementary group the account had, which on some servers removes access to Docker or a shared data folder.

adduser priya sudo does the same job and is easier to remember, because on Ubuntu adduser also adds an existing user to a named group.

Test the login before you close your session

Group membership is read when a session starts, so the old session cannot prove the change. Open a second one and test there.

1. In a new terminal, log in as the new account: ssh priya@your-server-ip.
2. Run sudo whoami and enter priya's password when asked.
3. Read the answer. root means sudo works for this account.
4. Optionally list the rights: sudo -l -U priya shows what the account may run.

You know it worked when the command returns root, not priya. Only then close the original root session. If the test fails, the original session is still open, which is exactly why the test comes before the disconnect.

Add a limited sudo rule in /etc/sudoers.d

Full root is not always the right grant. A drop-in file can allow named commands only, which suits a deploy account that restarts a service but never touches user accounts.

1. As an admin, run sudo visudo -f /etc/sudoers.d/priya.
2. Add one line: priya ALL=(root) /usr/bin/systemctl restart nginx.
3. Save and exit. In nano that is Ctrl and O, Enter, then Ctrl and X.
4. Test as priya: sudo systemctl restart nginx succeeds, and sudo cat /etc/shadow is refused.

You know it worked when the allowed command runs and an unrelated one is rejected with a sudoers message. Always edit through visudo: it checks syntax before saving, and a broken sudoers file can lock every admin out of sudo at once.

Fix the sudoers and group errors

Three messages cover almost every failed attempt. Each one has a single cause.

Root account: when to enable it, and how to switch it off

Ubuntu ships with the root account locked, which is why a fresh install cannot log in as root. If you need it for console recovery, set a password deliberately.

1. As a sudo user run sudo passwd root and set a strong password.
2. Switch to it with su -, which asks for the root password, not yours.
3. Leave it enabled only if console access depends on it. Otherwise lock it again with sudo passwd -l root.

SSH is a separate switch. PermitRootLogin no in /etc/ssh/sshd_config, followed by systemctl restart ssh, stops root logins over the network while leaving the console route open. Keep a tested sudo session open while you restart SSH. The root password guide covers the reset path when the old one is lost.

When to email support

Email support@webji.services when a VPS console refuses the new login, SSH stops accepting connections after a config change, or the sudo group is missing and you have no root session left to install it. Include the Ubuntu version, the exact command and the message it returned.

Email support is 24/7 in Hindi and English, and the average first reply is under 60 minutes. The office phone is not a support line. On VPS hosting you get root over SSH plus a console, so a broken sudoers file is recoverable without a rebuild; larger configurations are quoted by email before payment.