How to Add a User on Ubuntu and Give Them sudo

Running everything as the account your provider handed you works right up until it doesn’t. One account per person means you can take one away later without disturbing the others.

We’ll create a user, give them sudo, and set them up to log in with their own SSH key. The commands are the same on Ubuntu 26.04, 24.04 and 22.04, and all three are tested.

Before You Start

• A server running Ubuntu 26.04, 24.04 or 22.04, logged in as an account with sudo access
• The public key of whoever the account is for. If they haven’t got one, creating an SSH key takes a minute and they only need to send you the .pub half

Step 1: Create the User

sudo adduser yourusername

It asks for a password twice, then for a full name and three phone numbers you can leave blank by pressing enter, then Y to confirm. Reach for adduser rather than useradd, which is the lower-level tool underneath it and won’t create a home directory or a matching group unless you spell both out.

Step 2: Give Them sudo

sudo usermod -aG sudo yourusername

The -a appends. Leave it off and -G replaces every other group the account was in.

groups yourusername

yourusername : yourusername sudo users

You’re looking for sudo in that list (users turns up on 24.04 and later, and has no bearing on sudo rights).

Step 3: Add Their SSH Key

yourpublickey

That’s the whole public key on one line, ssh-ed25519 or ssh-rsa through to the comment on the end. Now hand the directory over and close the permissions down:

sudo chown -R yourusername:yourusername /home/yourusername/.ssh
sudo chmod 700 /home/yourusername/.ssh
sudo chmod 600 /home/yourusername/.ssh/authorized_keys

sshd ignores a key file other accounts can read, and it does it without telling anybody why.

sudo stat -c '%n %U %G %a' /home/yourusername /home/yourusername/.ssh /home/yourusername/.ssh/authorized_keys

/home/yourusername yourusername yourusername 750
/home/yourusername/.ssh yourusername yourusername 700
/home/yourusername/.ssh/authorized_keys yourusername yourusername 600

Every line should name the new user twice, then 750, 700 and 600.

Verify It Worked

sudo sshd -T -C user=yourusername,host=localhost,addr=127.0.0.1 | grep -E '^(pubkeyauthentication|authorizedkeysfile)'

pubkeyauthentication yes
authorizedkeysfile .ssh/authorized_keys .ssh/authorized_keys2

That’s sshd’s effective configuration for this particular user rather than the file’s defaults, so it accounts for a Match User block further down sshd_config. Keys will be accepted, and read from the file we wrote in step 3.

The login itself needs a second machine, so it’s the one check the run behind the badge on this page can’t make. From the machine holding the private key:

ssh yourusername@yourserverip

Then, once you’re in:

sudo whoami

You should be asked for the password from step 1, and get root back.

Troubleshooting

Permission denied reading the new user’s files

Drop the sudo from the check in step 3 and you’ll get this on 22.04 and 24.04:

stat: cannot statx '/home/yourusername/.ssh': Permission denied

Or this on 26.04, which ships the Rust rewrite of coreutils:

stat: cannot stat '/home/yourusername/.ssh': Permission denied (os error 13)

adduser creates home directories at 750, so you can’t look inside somebody else’s without sudo. That’s the right default and there’s nothing to fix.

Conclusion

You’ve got an account that logs in with its owner’s key and escalates with sudo, which is the point at which the provider’s default user can stop being everybody’s login. Installing Apache is a reasonable next move, and this is the account to do it with.

If any of this behaves differently on your setup, do drop me a line at [email protected] with the Ubuntu version you’re on and I’ll get it retested.