fren
Log In

Create a sudo user and secure root

2 min read07 November 2026

Working as root all the time is convenient until a mistyped command deletes the wrong directory. A named account with sudo reduces that risk and keeps a record of who did what. This guide creates that account, verifies it, then closes direct root SSH login without locking you out.

Create the account

Bash
adduser utilisateur

adduser is interactive: it asks for a password, then creates the home directory and a matching group. On Debian it also offers GECOS details and asks for confirmation. Use a unique password stored in a password manager.

Grant sudo and test

Bash
usermod -aG sudo utilisateur
id utilisateur

The -a option is essential: without it, -G replaces all existing secondary groups. id utilisateur must list sudo.

Group membership applies only to new sessions. Do not test with sudo in the current root terminal: open a separate connection, then in a second window:

Bash
ssh utilisateur@VOTRE_IPV6
sudo -l
sudo whoami

sudo whoami must return root. If you get utilisateur is not in the sudoers file, the group was not applied: reconnect or check id. If the login fails, do not disable root: the console is your only fallback.

Disable root login

Open /etc/ssh/sshd_config and find PermitRootLogin. It is often commented out; add or uncomment:

Text
PermitRootLogin no

Validate then reload:

Bash
sudo sshd -t
sudo systemctl reload ssh

On Debian 13 the service is ssh, not sshd. sshd -t checks syntax without applying it. A reload does not drop open sessions: keep your current root session alive until the final test.

Verify and roll back

From a new window, confirm root is refused:

Bash
ssh root@VOTRE_IPV6

The expected answer is Permission denied. Then confirm your user can still log in and use sudo. If something breaks, reopen the console, set PermitRootLogin prohibit-password or yes temporarily, reload, and fix the issue.

Best practices

  • One account per person, never a shared generic account.
  • Do not disable PasswordAuthentication before testing an SSH key.
  • Keep the console open during any sshd_config change.
  • Document the admin account and its recovery path.
  • Regularly audit getent group sudo and the files in /etc/sudoers.d/.

Removing direct root login does not remove root: the account still works from the console and through su -. That is the point: rare, explicit, audited access.

Advertisement

Was this article helpful?

Read next