How to Add a Non-Root Sudo User on Debian

Logging in as root is a habit that ages badly. Even when you are the only operator, putting a non-root account between you and the system makes audit logs honest and stops a slip of the finger from wiping /etc. This guide creates an operator account on Debian, grants it sudo, and locks the system down so root cannot SSH in directly.

Prerequisites

• A fresh Debian 12 server where you only have root credentials.
• An SSH public key (Ed25519) on your workstation.
• A second SSH session held open so you do not lock yourself out.

Step 1: Create the user

sudo adduser ops
# Set a strong password — even though you will use SSH keys, the password
# is the sudo password later.

adduser (vs. useradd) is the Debian-friendly wrapper that also creates the home directory and shell.

Step 2: Grant sudo

sudo apt install -y sudo
sudo usermod -aG sudo ops
id ops

The id output should now include sudo in the group list.

For passwordless sudo (only on hosts where you control physical access), drop a file in /etc/sudoers.d/:

echo 'ops ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/90-ops
sudo chmod 0440 /etc/sudoers.d/90-ops
sudo visudo -c            # syntax check; do not skip

For more typical setups, leave password-required and rotate that password quarterly.

Step 3: Push your SSH key

From your workstation:

ssh-copy-id ops@debian-host.example.sa

Test login without typing a password:

ssh -o PasswordAuthentication=no ops@debian-host.example.sa whoami
# Expected: ops

Step 4: Disable root SSH and password auth

/etc/ssh/sshd_config.d/99-skyline.conf:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

sudo sshd -t && sudo systemctl reload ssh

Never skip sshd -t — a syntax error on reload locks out new logins.

Step 5: Confirm sudo works for the operator

In the operator's session:

sudo -v
sudo whoami        # root
sudo -l            # list allowed commands

Verify

last -i | head     # who logged in recently
sudo grep -E 'COMMAND' /var/log/auth.log | tail
getent passwd ops  # account info

Conclusion

A non-root operator with sudo, key-based SSH, and root-login disabled is the minimum bar for any internet-facing Debian host. Two minutes of work, ten years of cleaner audit logs.

Next steps

• Turn on unattended security updates.
• Apply the UFW default-deny firewall (UFW works on Debian).
• Schedule housekeeping with cron jobs.