Overview

Running everything as root is risky. Best practice is to give each person or service a named account and grant elevated rights only where needed. This article shows how to create users and manage sudo access on your Linux Pod.

Before you begin

• Root or sudo access to the Pod.
• Understanding that sudo on Debian/Ubuntu uses the sudo group, while RHEL-family systems use the wheel group.

Create a user

```bash adduser deploy # Debian/Ubuntu (interactive)

or

useradd -m -s /bin/bash deploy && passwd deploy ```

Grant sudo access

```bash

Debian/Ubuntu

usermod -aG sudo deploy

RHEL family

usermod -aG wheel deploy ```

Verify group membership:

bash groups deploy

Add SSH key for the user

bash sudo -u deploy mkdir -p /home/deploy/.ssh sudo -u deploy chmod 700 /home/deploy/.ssh echo "ssh-ed25519 AAAAC3... [email protected]" | sudo tee /home/deploy/.ssh/authorized_keys sudo chmod 600 /home/deploy/.ssh/authorized_keys sudo chown deploy:deploy /home/deploy/.ssh/authorized_keys

Edit sudo rules safely

Never edit /etc/sudoers directly. Use visudo, which checks syntax before saving:

bash sudo visudo

For per-user rules, add a file in /etc/sudoers.d/:

bash sudo visudo -f /etc/sudoers.d/deploy

Example — allow passwordless restarts of nginx only:

deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx

Locking and removing accounts

bash sudo usermod -L deploy # lock password sudo usermod -U deploy # unlock sudo userdel -r deploy # remove user and home directory

Service accounts

For daemons, create system accounts without a login shell:

bash sudo useradd --system --no-create-home --shell /usr/sbin/nologin appsvc

Troubleshooting

• Problem: "user is not in the sudoers file". Solution: add the user to sudo (Debian/Ubuntu) or wheel (RHEL family) and have them log in again.
• Problem: sudoers syntax error locks out sudo. Solution: fix the file via rescue mode or a root session; visudo prevents most of these.
• Problem: SSH key login fails for the new user. Solution: check ownership and permissions on .ssh (700) and authorized_keys (600).

Related articles

• [Adding and managing SSH keys]
• [Initial server hardening after installation]
• [Changing the SSH port and disabling root login]