Secure User and Sudo Management on Ubuntu Servers

A step-by-step guide to creating new users, granting sudo privileges securely, and configuring passwordless sudo on an Ubuntu server.

Why Is Proper User Management Important?

On a production server, operating directly as the rootuser is a significant security risk. A single mistake can have catastrophic consequences. Creating dedicated user accounts with appropriate permissions follows the principle of least privilege, ensuring that users and services only have the access they absolutely need. This guide provides an idempotent and secure process for user management on Ubuntu.

Prerequisites

Before we begin, make sure you have:

• An Ubuntu server
• Access as the root user or another user with sudo privileges

Step 1: Create a New User Account

First, we’ll create a new user. We use the adduser command, which is a user-friendly interactive script that creates the user, their home directory, and prompts for a password and other information.

sudo adduser <username> # Replace <username> with your desired username

Step 2: Grant Sudo Privileges

To allow the new user to perform administrative tasks, we need to add them to the sudogroup. This grants them the ability to execute commands with root privileges.

sudo usermod -aG sudo <username> # Replace <username> with the user you just created

The flags used here are important:

• -a : Append the user to a group.
• -G : Specify the group (in this case, sudo).

This ensures the user is added to the sudo group without being removed from any other groups.

Step 3: Verify User and Sudo Access

It’s crucial to verify that the permissions were applied correctly before logging out of your current session.

First, switch to the new user’s account:

su - <username> # Replace <username> with the desired username

Next, check the user’s group membership to confirm they are in the sudo group:

groups

You should see sudo in the list of groups.

Finally, test sudoaccess by running a privileged command. whoami is a safe and simple test.

sudo whoami

If the command prompts for a password and then outputsroot, the user has been granted sudo privileges correctly.

Step 4 (Advanced): Configure Passwordless Sudo

For automation scripts or specific trusted users, you may want to enable sudo access without a password prompt.

Warning: Granting passwordless sudo should be done with extreme caution, as it increases the risk of unauthorized privileged operations if the user account is compromised.

The safest and most manageable way to do this is by adding a configuration file for the user in the/etc/sudoers.d/ directory. This avoids editing the main /etc/sudoers file directly, which can lock you out of sudoif a syntax error is introduced.

1. Use the visudo Command to create and edit the user-specific file. visudo will validate the syntax before saving.

sudo visudo -f /etc/sudoers.d/<username> # Replace <username>

2. Add the following line to the file. This grants the user passwordless sudo access for all commands.

<username> ALL=(ALL) NOPASSWD: ALL

Or restrict it to specific commands for tighter security:

<username> ALL=(ALL) NOPASSWD: /bin/systemctl, /usr/bin/docker

3. Save and exit the editor. The permissions for this file should be restrictive. visudo typically handles this, but you can verify they are set to 440.

sudo chmod 440 /etc/sudoers.d/<username> # Replace <username>

This method keeps your sudo rules organized and easily revocable — simply delete the file to remove the user’s passwordless access.

Conclusion

You have now successfully created a new user, granted them administrative privileges via the sudo group, and learned how to configure passwordless sudo in a secure and manageable way.

Note: For high-security or large-scale production environments, additional measures like SSH hardening, key-based authentication, and audit policies are recommended.