How to create a sudo user on a VPS and stop using root

Almost every new VPS starts the same way: you log in as root, install a few things, and a month later you're still root. It works right up until a script you pasted deletes the wrong directory. Setting up a normal user with sudo takes five minutes, and the order matters more than the commands — do it wrong and you lock yourself out.

Here's the safe sequence for Ubuntu 22.04/24.04 and Debian 12.

1. Create the user

As root:

adduser deploy
usermod -aG sudo deploy

adduser asks for a password and some optional details (just press Enter through those). Pick a real password: you'll type it for sudo. On a minimal Debian image, run apt install -y sudo first if the command is missing.

2. Give it your SSH key

The easiest way is to copy root's authorized keys, keeping ownership right:

rsync --archive --chown=deploy:deploy /root/.ssh /home/deploy

If you prefer to do it by hand:

mkdir -p /home/deploy/.ssh
cp /root/.ssh/authorized_keys /home/deploy/.ssh/
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

Wrong permissions are the classic reason key login silently fails. SSH ignores an authorized_keys that other users can write to.

3. Test before you change anything

Keep your root session open. In a new terminal:

ssh -p 22 deploy@203.0.113.10
sudo whoami

Use your own IP and port — on a NAT plan that's your personal SSH port from the dashboard. If sudo whoami prints root, you're good. If the login fails, you still have the root window to fix it.

4. Turn off root login

Now close the door. Create a small drop-in file instead of editing the main config:

cat > /etc/ssh/sshd_config.d/10-hardening.conf <<'EOF'
PermitRootLogin no
PasswordAuthentication no
EOF
sshd -t && systemctl reload ssh

sshd -t checks the syntax first. A broken config plus a reload is how people end up needing the console. PasswordAuthentication no only makes sense once key login works for your new user — which you just tested.

Open one more terminal and confirm root is refused and deploy still gets in. Then close the old root session.

5. Optional: passwordless sudo for automation

If a deploy script needs sudo without a prompt, give it exactly that and nothing wider:

visudo -f /etc/sudoers.d/deploy

deploy ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart myapp

Honestly, NOPASSWD: ALL is tempting, but it means a stolen key equals root. Limit it to the commands the automation runs.

If something goes wrong

The web console in your dashboard doesn't depend on SSH or the firewall. Log in there, fix the file in /etc/ssh/sshd_config.d/, reload, done. We wrote up the full recovery flow in how to get back into a locked-out VPS.

What to do next

• Switch to key-only login properly: SSH key authentication.
• Slow down brute-force noise: fail2ban.
• Go through the rest of the basics with the new VPS security checklist.

Access options for every plan are in the access docs. Even a $3 Nano deserves a non-root user — it's the cheapest security upgrade there is.