Running everything as root is the single most common mistake on new Ubuntu servers. The root account has unlimited power — there is no confirmation, no undo, and no audit trail. The professional approach on Ubuntu 24.04 is a personal user with sudo privileges: you work as a normal user and elevate only when needed, with every elevated command logged in /var/log/auth.log.
Step 1 — Create the new user
Logged in as root (or another sudo user), run:
adduser sarah
Ubuntu's adduser is friendlier than the low-level useradd: it creates the home directory, copies default dotfiles and prompts for a password interactively. Pick a strong password — better yet, plan to switch to SSH key authentication and disable passwords entirely.
Step 2 — Add the user to the sudo group
On Ubuntu, membership of the sudo group is what grants administrative rights:
usermod -aG sudo sarah
The -aG flags mean append to the group — do not forget the -a, or you will replace the user's existing groups instead of adding one.
Step 3 — Verify sudo access
su - sarah sudo whoami
If the output is root, your new account can administer the server.
Step 4 — Disable direct root login
Once the sudo user works (test it in a second SSH session before closing your current one), lock root out of SSH. Edit /etc/ssh/sshd_config:
PermitRootLogin no
Then restart SSH:
sudo systemctl restart ssh
Useful sudo tricks
Run a whole root shell when you have many commands: sudo -i. Repeat the last command with sudo after a “permission denied”: sudo !!. See what a user may run: sudo -l -U sarah. Remove sudo rights again with gpasswd -d sarah sudo.
Frequently asked questions
Why not just use root with a strong password?
Because every attacker on earth knows the username is root — half of the brute-force problem is already solved for them. A named sudo user plus Fail2Ban and key-only SSH reduces that attack surface to effectively zero.
What is the difference between sudo and su?
su switches to the root account and requires the root password. sudo runs a single command with elevation using your own password, is logged per-command, and can be granted or revoked per user.
Related Ubuntu guides
- Initial Ubuntu 24.04 Server Setup Guide: Secure Your New VPS in 10 Steps
- How to Secure SSH on Ubuntu: Key Authentication, Custom Port and Best Practices
- How to Manage Users and Groups on Ubuntu Server
- How to Set Up UFW Firewall on Ubuntu 24.04: Complete Configuration Guide
Prefer to have experts handle it?
LFA IT provides fully managed Ubuntu VPS and dedicated servers — initial setup, security hardening, monitoring and 24/7 support, so you can focus on your business. Explore our hosting and server management services or open a support ticket and our engineers will take it from there.
