Create a user with sudo

Work with a normal user instead of root.

1. Create a user (adjust the name):

   adduser max

2. Add to the admin group so that sudo works:

   usermod -aG sudo max

3. Store the SSH key for the new user:

   ssh-copy-id -i ~/.ssh/id_ed25519.pub max@IP-ADDRESS

4. Test in a new terminal:

   ssh max@IP-ADDRESS
   sudo -v

Why a separate user?

With sudo, every admin action can be traced individually. Root login itself is blocked in the next step.

How sudo controls rights (sudoers)

The file /etc/sudoers defines which users may use sudo. On Debian and Ubuntu, the file contains this line by default:

%sudo   ALL=(ALL:ALL) ALL

The % means: applies to a group. Every user in the group sudo may run all commands as any user. That is why the step usermod -aG sudo max is enough, and the sudoers file does not need to be edited.

On RHEL-based systems (Rocky, Alma) the group is called wheel, so the command is usermod -aG wheel max.

Add a single user directly

Only needed if one particular user should get sudo without being in the group. Edit the file only with visudo, which checks the syntax before saving. A faulty sudoers file would otherwise lock out all admins.

sudo visudo -f /etc/sudoers.d/max

Enter exactly this one line and save:

max ALL=(ALL:ALL) ALL

Then check the permissions and the syntax:

sudo chmod 440 /etc/sudoers.d/max
sudo visudo -c

Avoid entries such as NOPASSWD. Otherwise sudo no longer asks for a password, and a stolen login gets full access immediately.