Create a sudo user

Root is the account that can do anything, including delete the whole disk with one typo. Use it for one job only: creating a normal administrator account. From then on, do daily work as that user and elevate single commands with sudo.

Create the account

In the root session, create a user called deploy and add it to Ubuntu’s sudo group:

adduser deploy
usermod -aG sudo deploy
id deploy

adduser asks for a password and a few optional details. Fill in the password, press Enter for the rest. The password protects sudo on the server. SSH will keep using your key.

id deploy should print something like uid=1000(deploy) gid=1000(deploy) groups=1000(deploy),27(sudo). The 27(sudo) part is what we’re after.

Copy the authorized key

Root already has your public key in ~/.ssh/authorized_keys. Copy the whole .ssh directory to the new user and hand over ownership in one go:

rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

SSH is strict about permissions on these files. If anyone other than the owner can write them, it silently ignores the key. Check every directory in the path:

namei -l /home/deploy/.ssh/authorized_keys

Each line shows one path component with its permissions and owner. deploy must be able to reach the file, and .ssh and authorized_keys must belong to deploy and be writable by nobody else.

Test from a second terminal

Leave the root session open. From a new local terminal, log in as the new user and check that sudo works:

ssh -i ~/.ssh/digitalocean_notes [email protected]
sudo whoami

The first command opens a shell as deploy. The second asks for the password and prints root. Run sudo -l too, to see what the sudo group grants you.

The common failure

Wrong ownership is what breaks this step nine times out of ten. You copied the files as root and forgot --chown, so the key belongs to root and SSH refuses it. Fix it from the root session you kept open:

chown -R deploy:deploy /home/deploy/.ssh

That open root session is the whole point. Never close it until key login and sudo both work in a fresh connection. If you do lock yourself out, use the DigitalOcean recovery console to repair the account. Don’t turn on password login over the network as a shortcut.

Once the second login works, run whoami, groups and sudo whoami in it. All three print something different. Make sure you can explain why.