How to create a sudo user on AlmaLinux and Rocky Linux

On AlmaLinux and Rocky Linux, the wheel group is the sudo group: create the user with useradd -m deploy, set its password with passwd deploy, and add it with usermod -aG wheel deploy. Then copy your SSH key to it, check that sudo works, and put PermitRootLogin no in /etc/ssh/sshd_config.d/01-no-root-login.conf to stop root logging in over SSH.

The commands are the same on AlmaLinux 9, AlmaLinux 10 and Rocky Linux 9. Keep your root session open until the final check passes; it's your way back in if a step goes wrong.

The examples use deploy as the user and 203.0.113.10 as the server. Use your own.

Create the user and add it to wheel#

useradd -m deploy
passwd deploy
usermod -aG wheel deploy

useradd -m creates the home directory. passwd sets the password that sudo will ask for; SSH keeps using your key. -aG adds wheel to the user's groups without removing any (plain -G replaces them).

Check it worked#

id deploy
grep '^%wheel' /etc/sudoers

id lists 10(wheel) in the groups, and the sudoers line is %wheel ALL=(ALL) ALL: every member of wheel may run any command as root, after typing their own password. It ships enabled; you don't need to edit /etc/sudoers.

Copy your SSH key#

Copy root's authorized keys to the new user with the right owner and modes, then restore the SELinux labels:

install -d -m 700 -o deploy -g deploy /home/deploy/.ssh
install -m 600 -o deploy -g deploy /root/.ssh/authorized_keys /home/deploy/.ssh/authorized_keys
restorecon -R -v /home/deploy/.ssh

restorecon is the step people miss on RHEL-family systems. With SELinux enforcing (the default), sshd can only read files labelled ssh_home_t. Files created in the new home directory usually get that label anyway, but a file moved in from elsewhere keeps its old one, and SSH then refuses the key with no obvious reason. restorecon sets the correct labels, and prints nothing when they already were.

Check it worked#

From your computer, in a new terminal:

ssh deploy@203.0.113.10
sudo whoami

The first time, sudo shows a short lecture, asks for the password you set with passwd, then prints root.

Disable root login over SSH#

sshd reads the files in /etc/ssh/sshd_config.d/ in name order and keeps the first value it finds for each setting. AlmaLinux 10 ships 25-permitrootlogin.conf, which sets PermitRootLogin yes; a file whose name starts with 01- is read before it and wins:

echo 'PermitRootLogin no' | sudo tee /etc/ssh/sshd_config.d/01-no-root-login.conf
sudo sshd -t && sudo systemctl reload sshd

The service is sshd here, not ssh as on Ubuntu and Debian. sshd -t prints nothing when the configuration is valid.

Check it worked#

sudo sshd -T | grep -i '^permitrootlogin'

It must print permitrootlogin no. Then, from your computer:

ssh root@203.0.113.10      # Permission denied
ssh deploy@203.0.113.10    # works

Close the root session only after the second command works.

Troubleshooting#

deploy is not in the sudoers file. Group changes only apply to new logins. Log out and back in. If id doesn't show wheel, run usermod -aG wheel deploy again as root.

The key works for root but not for deploy. Check the modes (ls -la /home/deploy/.ssh: drwx------ and -rw-------, owner deploy) and the labels (ls -Z /home/deploy/.ssh/authorized_keys should show ssh_home_t). restorecon -R -v /home/deploy/.ssh fixes the labels. journalctl -u sshd -n 20 shows why SSH refused.

Root still gets in. A file read earlier sets PermitRootLogin. grep -ri permitrootlogin /etc/ssh/sshd_config /etc/ssh/sshd_config.d/ lists them; yours needs the lowest number.

Locked out. Log in on the serial console with root's password (root can still log in there; this change only affects SSH) and remove /etc/ssh/sshd_config.d/01-no-root-login.conf.

Next steps#

• Open only the ports you use with firewalld.
• Work through the SSH hardening checklist. It's written for Ubuntu and Debian, but the sshd settings are the same; reload sshd instead of ssh.
• On Ubuntu or Debian the steps differ a little: see create a sudo user on Ubuntu and Debian.

Doing it on VPSNine#

VPSNine offers AlmaLinux 10, AlmaLinux 9 and Rocky Linux 9 on every plan, from the projects' own cloud images. You log in as root with the SSH key you picked at order time. The secure server setup script creates a sudo user and switches SSH to keys only on first boot, if you'd rather not do it by hand. Not sure which of the two to pick? Read AlmaLinux vs Rocky Linux.