# How to create a sudo user on AlmaLinux and Rocky Linux

> Add a user to the wheel group on AlmaLinux or Rocky Linux, give it your SSH key with the right SELinux labels, and turn off root logins over SSH.

Source: https://vpsnine.com/tutorials/create-a-sudo-user-almalinux-rocky · Updated: 2026-10-21

Difficulty: beginner · Time: about 15 minutes · Tested on: AlmaLinux 10, Rocky Linux 9

Prerequisites:

- A server running AlmaLinux or Rocky Linux
- An SSH session as root with a key

On AlmaLinux and Rocky Linux, the `wheel` group is the sudo group: create the user with `useradd -m deploy`, set its password with `passwd deploy`, and add it with `usermod -aG wheel deploy`. Then copy your SSH key to it, check that `sudo` works, and put `PermitRootLogin no` in `/etc/ssh/sshd_config.d/01-no-root-login.conf` to stop root logging in over SSH.

The commands are the same on AlmaLinux 9, AlmaLinux 10 and Rocky Linux 9. Keep your root session open until the final check passes; it's your way back in if a step goes wrong.

The examples use `deploy` as the user and `203.0.113.10` as the server. Use your own.

## Create the user and add it to wheel

```bash
useradd -m deploy
passwd deploy
usermod -aG wheel deploy
```

`useradd -m` creates the home directory. `passwd` sets the password that `sudo` will ask for; SSH keeps using your key. `-aG` adds `wheel` to the user's groups without removing any (plain `-G` replaces them).

### Check it worked

```bash
id deploy
grep '^%wheel' /etc/sudoers
```

`id` lists `10(wheel)` in the groups, and the sudoers line is `%wheel  ALL=(ALL)  ALL`: every member of `wheel` may run any command as root, after typing their own password. It ships enabled; you don't need to edit `/etc/sudoers`.

## Copy your SSH key

Copy root's authorized keys to the new user with the right owner and modes, then restore the SELinux labels:

```bash
install -d -m 700 -o deploy -g deploy /home/deploy/.ssh
install -m 600 -o deploy -g deploy /root/.ssh/authorized_keys /home/deploy/.ssh/authorized_keys
restorecon -R -v /home/deploy/.ssh
```

`restorecon` is the step people miss on RHEL-family systems. With SELinux enforcing (the default), `sshd` can only read files labelled `ssh_home_t`. Files created in the new home directory usually get that label anyway, but a file moved in from elsewhere keeps its old one, and SSH then refuses the key with no obvious reason. `restorecon` sets the correct labels, and prints nothing when they already were.

### Check it worked

From your computer, in a new terminal:

```bash
ssh deploy@203.0.113.10
sudo whoami
```

The first time, `sudo` shows a short lecture, asks for the password you set with `passwd`, then prints `root`.

## Disable root login over SSH

`sshd` reads the files in `/etc/ssh/sshd_config.d/` in name order and keeps the first value it finds for each setting. AlmaLinux 10 ships `25-permitrootlogin.conf`, which sets `PermitRootLogin yes`; a file whose name starts with `01-` is read before it and wins:

```bash
echo 'PermitRootLogin no' | sudo tee /etc/ssh/sshd_config.d/01-no-root-login.conf
sudo sshd -t && sudo systemctl reload sshd
```

The service is `sshd` here, not `ssh` as on Ubuntu and Debian. `sshd -t` prints nothing when the configuration is valid.

### Check it worked

```bash
sudo sshd -T | grep -i '^permitrootlogin'
```

It must print `permitrootlogin no`. Then, from your computer:

```bash
ssh root@203.0.113.10      # Permission denied
ssh deploy@203.0.113.10    # works
```

Close the root session only after the second command works.

## Troubleshooting

**`deploy is not in the sudoers file.`** Group changes only apply to new logins. Log out and back in. If `id` doesn't show `wheel`, run `usermod -aG wheel deploy` again as root.

**The key works for root but not for `deploy`.** Check the modes (`ls -la /home/deploy/.ssh`: `drwx------` and `-rw-------`, owner `deploy`) and the labels (`ls -Z /home/deploy/.ssh/authorized_keys` should show `ssh_home_t`). `restorecon -R -v /home/deploy/.ssh` fixes the labels. `journalctl -u sshd -n 20` shows why SSH refused.

**Root still gets in.** A file read earlier sets `PermitRootLogin`. `grep -ri permitrootlogin /etc/ssh/sshd_config /etc/ssh/sshd_config.d/` lists them; yours needs the lowest number.

**Locked out.** Log in on the [serial console](https://vpsnine.com/help/serial-console) with root's password (root can still log in there; this change only affects SSH) and remove `/etc/ssh/sshd_config.d/01-no-root-login.conf`.

## Next steps

- Open only the ports you use with [firewalld](https://vpsnine.com/tutorials/firewalld-almalinux-rocky).
- Work through the [SSH hardening checklist](https://vpsnine.com/help/ssh-hardening-checklist). It's written for Ubuntu and Debian, but the `sshd` settings are the same; reload `sshd` instead of `ssh`.
- On Ubuntu or Debian the steps differ a little: see [create a sudo user on Ubuntu and Debian](https://vpsnine.com/tutorials/create-a-sudo-user-ubuntu-debian).

## Doing it on VPSNine

VPSNine offers [AlmaLinux 10](https://vpsnine.com/os/almalinux-10), [AlmaLinux 9](https://vpsnine.com/os/almalinux-9) and [Rocky Linux 9](https://vpsnine.com/os/rocky-9) on every [plan](https://vpsnine.com/plans), from the projects' own cloud images. You log in as root with the SSH key you picked at order time. The [secure server setup script](https://vpsnine.com/help/secure-server-setup-script) creates a sudo user and switches SSH to keys only on first boot, if you'd rather not do it by hand. Not sure which of the two to pick? Read [AlmaLinux vs Rocky Linux](https://vpsnine.com/tutorials/almalinux-vs-rocky-linux).