How to create an admin user in Ubuntu and Linux

Run this from an account that already has sudo:

sudo adduser alice
sudo usermod -aG sudo alice

Replace alice with your username. On Ubuntu (24.04 and 26.04 LTS) and Debian that's it: /etc/sudoers gives the sudo group full root rights. On Fedora, RHEL, CentOS, Rocky and AlmaLinux the group is wheel.

Tested on Ubuntu 24.04 and 26.04, Debian 12 and 13, Fedora 45, AlmaLinux 9 and 10.

What adduser asks

adduser creates a group and home directory for the user and sets /bin/bash as the shell, then asks for:

• the password, twice;
• Full Name, Room Number, Work Phone, Home Phone, Other: Enter skips each one;
• Is the information correct? [Y/n]: Enter.

sudo adduser alice sudo (user, then group) does the same as the usermod line.

Create an admin user without prompts

For scripts, use useradd. Without -m it creates no home directory, and on Ubuntu its default shell is /bin/sh, so pass both:

sudo useradd -m -s /bin/bash -G sudo alice
sudo passwd alice

In a script, use chpasswd with the password in a variable, so it isn't written in the script or visible in the process list:

printf '%s:%s\n' alice "$ALICE_PASSWORD" | sudo chpasswd

Use printf, not echo: in /bin/sh on Ubuntu and Debian, echo mangles backslashes in the password.

For an account that logs in only with an SSH key:

sudo adduser --disabled-password --gecos "" alice
sudo usermod -aG sudo alice

This user has no password, yet sudo will ask for one. Set it with sudo passwd alice or allow passwordless sudo (below).

Check that the user is an admin

groups alice
sudo -l -U alice

groups must list sudo (wheel on Fedora/RHEL), and sudo -l -U must include (ALL : ALL) ALL ((ALL) ALL on Fedora/RHEL). For a regular user it says User alice is not allowed to run sudo. The real test is to log in as alice:

su - alice
sudo whoami   # prints root

"alice is not in the sudoers file": log in again

With classic sudo (Ubuntu 24.04, Debian, Fedora, RHEL) groups are fixed at login. If alice already had a session open, usermod doesn't change it: groups inside that session shows the old list, and sudo replies alice is not in the sudoers file. She has to log out and back in, or reconnect over SSH. groups alice reads /etc/group and shows sudo right away, so it won't reveal the problem.

Ubuntu 26.04 uses sudo-rs by default. It reads /etc/group on every call, so new rights work in an open session at once. A user without them gets I'm sorry alice. I'm afraid I can't do that.

Create an admin user on Debian

Same commands, same sudo group. One catch: if you set a root password in the Debian installer, it doesn't install sudo and doesn't add your user to the group. Fix it as root:

su -
apt install sudo
usermod -aG sudo alice

Keep the dash in su -. Plain su on Debian keeps your PATH without /usr/sbin, and you get usermod: command not found.

Fedora, RHEL, CentOS: the wheel group

sudo useradd alice
sudo passwd alice
sudo usermod -aG wheel alice

Here adduser is a symlink to useradd: it asks nothing and leaves the account without a password, so don't skip passwd. The home directory and /bin/bash are the defaults.

Passwordless sudo

Put a rule in /etc/sudoers.d and check its syntax first:

t=$(mktemp)
echo 'alice ALL=(ALL) NOPASSWD:ALL' > "$t"
sudo visudo -cf "$t" && sudo install -m 0440 "$t" /etc/sudoers.d/alice
rm "$t"

visudo -cf prints parsed OK or points at the error. mktemp creates a file only you can write to. Another user can create a fixed name like /tmp/alice before you, and you'd install their rule. Don't put a dot in the file name: sudo skips files in /etc/sudoers.d that contain . or end in ~, so alice.conf silently does nothing. For manual edits, sudo visudo -f /etc/sudoers.d/alice won't save a broken file.

Add an SSH key for the new user

From your laptop, if the server accepts password logins (how to allow them):

ssh-copy-id alice@server

If you don't have a key yet, ssh-keygen -t ed25519 creates one (more on SSH keys on a Mac).

Without a password ssh-copy-id can't log in, so add the key on the server as an admin:

sudo mkdir -p /home/alice/.ssh
echo 'ssh-ed25519 AAAA... you@laptop' | sudo tee -a /home/alice/.ssh/authorized_keys
sudo chown -R alice:alice /home/alice/.ssh
sudo chmod 700 /home/alice/.ssh
sudo chmod 600 /home/alice/.ssh/authorized_keys

If .ssh or authorized_keys is writable by others, sshd ignores the key and answers Permission denied.

Remove admin rights

sudo gpasswd -d alice sudo     # wheel on Fedora/RHEL
sudo rm /etc/sudoers.d/alice   # only if you created it

With classic sudo, sessions alice already has open keep sudo until she logs out. sudo pkill -KILL -u alice ends them, along with all her processes. On Ubuntu 26.04 (sudo-rs) the removal works at once.

On Ubuntu and Debian sudo deluser alice sudo also works. To delete the account with its home directory: sudo deluser --remove-home alice on Ubuntu and Debian, sudo userdel -r alice everywhere.

Common mistakes

• usermod -G sudo alice without -a replaces all of alice's extra groups with sudo alone. Always use -aG.
• For a root shell, sudo -i is enough. The sudo su from my 2017 version of this post stacks two tools for the same result.
• Ubuntu's /etc/sudoers also has a %admin line, but no admin group exists by default. Use sudo.