Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCreate a named account, place it in the administrative group used by your distribution, and validate a second SSH session before changing root-login settings. Debian and Ubuntu normally use the sudo group; RHEL-family systems normally use wheel. Keep your existing root or administrator connection open until the new account can run sudo -l successfully.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you need before changing the VPS
You need a working root shell or an existing account that already has sudo rights. You also need the server address and, if you plan to use key authentication, the new user’s public key. Keep the current privileged SSH window open throughout the setup. If a group change, key-copy mistake, or sudoers syntax error prevents the new login, that session is your recovery path.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Use a second terminal for every test rather than replacing the only working connection.
- Know whether the image is Debian/Ubuntu or RHEL/Fedora based; the administrative group differs.
- Have the provider’s serial console or recovery console available in case SSH becomes unavailable.
- Do not disable direct root login or password authentication until the replacement account has completed both an SSH login and a sudo test.
This procedure uses account, SSH, and sudo tools supplied by the operating system. No additional paid software or product is required. Your VPS hosting charge does not change because you create another local account; any optional security key or provider service is a separate operational choice.
Identify the Linux distribution
From the existing administrator session, run:
cat /etc/os-releaseRead the ID, ID_LIKE, and version fields. The commands below follow the distribution conventions documented for the two major families. An image can customize its sudoers policy, so verify the effective policy instead of assuming that a group name alone grants access.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Distribution family | Account creation | Usual administrative group | Policy location |
|---|---|---|---|
| Debian or Ubuntu | adduser username |
sudo |
/etc/sudoers and included files |
| RHEL, CentOS Stream, or Fedora family | useradd -m -s /bin/bash username, then set a password if required |
wheel |
/etc/sudoers and /etc/sudoers.d/ |
The group name is a convention, not a complete permission test. The sudoers policy must contain a rule that authorizes that group, and a provider image may change or remove the usual rule. Treat id as a membership check and sudo -l as the authorization check.
Create an administrative user on Ubuntu or Debian
1. Create the account and home directory
Ubuntu documents the interactive adduser tool and notes that Debian-based systems encourage the adduser package for account management. Replace username with the login name you want to audit:
sudo adduser usernameThe command creates the account and home directory, then asks for a password and optional descriptive fields. Press Enter to leave an optional field blank. If you are already logged in as root, the same commands work without the leading sudo. Choose a stable, individual login name rather than a shared administrator identity so later login and sudo records can be attributed to one person or automation account.
2. Add the user to the sudo group
sudo adduser username sudoThe equivalent lower-level command is:
sudo usermod -aG sudo usernameThe -aG form appends the group while preserving the user’s existing supplementary groups. Omitting -a can replace those groups, so do not shorten the command to usermod -G sudo unless you intentionally want to rebuild the complete group list. Adding the account to the group does not retroactively alter an already-running shell; plan to reconnect before testing.
Create an administrative user on RHEL-family systems
1. Create the account
On images that provide the standard system tools, create a home directory and login shell with:
sudo useradd -m -s /bin/bash usernameSet a password if the image or your login policy requires one:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutesudo passwd usernamePublic-key-only SSH access can still be used; a local password is a separate decision controlled by the image and SSH configuration. Creating a password does not by itself enable password-based SSH login, and disabling password authentication later does not remove the local account.
2. Add the user to wheel
sudo usermod -aG wheel usernameRHEL stores sudo authorizations in /etc/sudoers and /etc/sudoers.d/. The standard administrative arrangement grants rights to the wheel group, but an image may alter or remove that rule. Confirm the rule and the user’s effective permissions after reconnecting rather than treating membership as proof of authorization.
Start a fresh login before testing
Supplementary groups are normally assigned when a login session starts. An existing shell may therefore continue to show the old group list even after usermod or adduser succeeds. Open a new SSH connection as the new account, or log out and back in. Starting a subshell in the old connection is not a reliable substitute for a fresh login.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
From the new session, check membership:
id usernameFor a logged-in shell, id without an argument is also useful:
idOn Debian or Ubuntu, the output should include sudo. On a RHEL-family image, it should include wheel. If the group is absent, reconnect again and inspect the account’s supplementary groups from the privileged session. If membership is correct but sudo is denied, inspect the policy rather than repeatedly re-running the group command.
Verify sudo without changing the server
Run these checks from the new account:
sudo -lsudo -l displays the commands allowed by the host’s current sudoers policy. It may ask for the new user’s password, depending on that policy. A credential-only validation that does not execute an administrative command is:
sudo -vDo not assume that every member of an administrative group has unrestricted access. A local sudoers rule can limit commands, require a password, or impose other conditions. The output of sudo -l is the authoritative check for this account on this host. If it lists a command set narrower than expected, stop and correct the policy while the original administrator session remains open.
Install an SSH public key for the new user
Using a key gives the account a repeatable login identity and avoids sending a password over an interactive SSH exchange. The public key belongs in the user’s authorized_keys file; never copy a private key to the VPS.
Find the home directory when necessary
For a standard account it is /home/username. If the image uses a different home path, retrieve it from the account database:
getent passwd usernameThe home directory is the sixth colon-separated field in that output. Use the returned path in every subsequent key-installation command.
Install the key from the administrator session
Save the user’s public key as a temporary file on the VPS, for example /tmp/username_ed25519.pub, or paste its contents into a file without wrapping the line. Then run:
sudo install -d -m 700 -o username -g username /home/username/.ssh
sudo install -m 600 -o username -g username /tmp/username_ed25519.pub /home/username/.ssh/authorized_keysThe first command creates .ssh with owner-only access. The second places the public key in the expected filename and assigns ownership to the new user. If you use a nonstandard home directory, substitute that path in both commands. Remove the temporary public-key file when you no longer need it, but do not remove an existing working key until the replacement connection has succeeded.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Check that the home directory and every parent directory allow the SSH daemon to traverse them, while the key file remains owned by the target user. Preserve any key already installed by cloud-init or the VPS image until the replacement login has been tested. A key copied with root ownership or permissive modes can be rejected by SSH even when its text is correct.
Test key authentication before removing an old key
Open another terminal and connect with the new account and its private key:
ssh -i /path/to/private_key username@server-addressOnce connected, run id, sudo -l, and, if required, sudo -v. Keep the original administrator session open until all three checks work. Do not delete the only existing authorized key before this test passes.
Choose the authorization method that fits the job
| Method | Scope | When it fits | Main caution |
|---|---|---|---|
| Distribution administrative group | Whatever the image grants to sudo or wheel |
A human administrator needs the normal host-management rights | Membership may be broader than a particular task requires |
| Per-user sudoers drop-in | One account and an explicitly listed command set | An operator or service needs narrowly defined elevation | Every required executable and path must be named correctly |
| Existing provider account | Depends on the VPS image and cloud-init configuration | The image already provisions a managed administrative identity | Changing its keys or groups can break provider access |
Use the group convention for ordinary full administrators and a named sudoers rule for least-privilege work. In either case, verify the resulting policy with sudo -l. A broad group is simpler to maintain for several administrators; a drop-in makes the scope explicit for one operator or service account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Grant limited or full access with a sudoers drop-in
Sudoers files control who may run which commands. When access should not be inherited from a broad group, create a separate file under /etc/sudoers.d/ with visudo:
sudo visudo -f /etc/sudoers.d/usernamevisudo checks syntax before installing the edit. Do not overwrite /etc/sudoers with an ordinary text editor: one malformed line can prevent sudo from parsing the policy and can remove your normal administrative path. A drop-in also keeps a user-specific change separate from distribution-managed defaults.
Full administrative rule
This rule grants the named account the same unrestricted command scope expressed by the common administrator policy:
username ALL=(ALL) ALLUse it only when the account genuinely needs full administrative access. A group-based rule is usually easier to manage when several administrators share the same policy.
Command-limited rule
A constrained rule must list the exact commands and paths required by the task. For example, a maintenance account might be permitted to run one service-management command and one log-reading command, while remaining unable to run arbitrary shells or package managers. Write the precise command paths and arguments required by your workload; do not replace them with a broad wildcard simply to make an early test pass. Verify the resulting list with sudo -l from the target account and test only the intended harmless or read-only operation.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
After saving a drop-in, reconnect as the target user and run:
sudo -lIf the result is not what you intended, return to the still-open administrator session, run visudo again, and correct the rule before making any SSH-hardening change.
Troubleshoot common failures
“User is not in the sudoers file”
- Run
id usernamefrom the administrator session and confirmsudoorwheelis present. - Reconnect as the user; an old shell may not have the new supplementary group.
- Confirm that the relevant group is actually authorized in
/etc/sudoersor an included file under/etc/sudoers.d/. - Use
sudo -lafter the new login to see the effective policy.
If the group is present but authorization is still denied, the image’s sudoers policy does not grant that group the expected rights. Correct the policy with visudo while retaining the original privileged session. Do not solve the message by granting unrestricted access blindly; first determine whether the account needs a full administrative rule or a command-limited one.
“sudo: command not found”
The image may not have the sudo package installed, or the new account’s PATH may be incomplete. From the provider console or an existing root session, install the distribution’s sudo package using its supported package manager. Package names, repositories, and package-manager commands vary by image. Reconnect and repeat sudo -l after installation. Until sudo is installed, use the still-open root or console session rather than changing SSH settings.
SSH says “Permission denied (publickey)”
- Confirm that the client is using the private key corresponding to the public key installed on the VPS.
- Check that
authorized_keyscontains the complete key on one line, with no accidental quotation marks or line wrapping. - Check ownership: the user should own the
.sshdirectory andauthorized_keys. - Use restrictive permissions: the directory should be mode
700and the key file mode600in the installation shown above. - Check home-directory traversal permissions and the SSH daemon’s configuration for a different authorized-keys path.
- Follow the service log while making a test connection with
journalctl -fu ssh.service.
The account can log in but cannot use the key after a cloud-image change
Provider images may use cloud-init or a preconfigured account with its own SSH settings. Preserve that account’s working key and configuration while you add the named user. Compare the image’s SSH configuration and home path with the commands above, then test the new key in a separate terminal. Do not replace provider-managed files or keys merely because the new account has been created.
A sudoers edit caused an access problem
Do not close the original privileged session. Use it to run visudo -c and identify a syntax error, then edit the affected file with visudo -f. If SSH is unavailable, use the provider’s console or recovery environment. Removing a broken drop-in is safer than repeatedly editing the main file with an ordinary editor. Once parsing succeeds, reconnect and run sudo -l again.
Recommended Free Tools
Harden access only after the replacement path works
Once the new account has completed a fresh SSH login, shown the expected group with id, and passed sudo -l, you can evaluate SSH hardening for this particular VPS image. Common changes include disabling direct root login, disabling password authentication when every required user has a tested public key, and removing obsolete keys. These settings are image- and operations-dependent, so change one setting at a time and keep a console or existing recovery path available.
A named account is easier to attribute than routine shared-root use: login records identify the person or automation identity, while sudo logs show elevated commands according to the host’s configured logging policy. Give each administrator an individual account rather than distributing one shared username, and remove membership or keys when access is no longer required. Review the effective policy periodically, especially after changing a group rule or adding a provider-managed account.
How the choices compare in practice
The administrative group is the shortest path when a person needs the distribution’s normal host-management rights. It also means accepting every command that the image grants to that group. A per-user drop-in takes more care because each executable and path must be named, but its scope is visible and easier to constrain for maintenance or automation. Editing the main sudoers file may affect the whole host; a validated drop-in limits the blast radius of a user-specific change.
Authentication and authorization are separate decisions. A password may satisfy sudo’s prompt while SSH is restricted to public keys, or SSH may accept a key while sudo requires a local password. Test both layers independently: first establish the SSH session, then inspect the sudo policy. The correct choice depends on the image’s existing configuration and your operational requirements, not on the group name alone.
A repeatable operating procedure
- Keep the current root or administrator session open.
- Identify the distribution with
cat /etc/os-release. - Create the account with
adduseron Debian/Ubuntu oruseradd -m -s /bin/bashon a RHEL-family image. - Add the account to
sudoorwheel, or create a command-limited drop-in withvisudo. - Install the public key with user ownership and restrictive permissions if key login is required.
- Start a completely new SSH session as the account.
- Run
id,sudo -l, and the harmless credential checksudo -v. - Only after those checks succeed, consider disabling direct root login, removing old keys, or changing password authentication.
Frequently Asked Questions
What is the sudo group on Ubuntu and Debian?
The normal administrative group is sudo. Create the account with adduser username, then run adduser username sudo or usermod -aG sudo username. Confirm the group appears after a fresh login and verify the effective policy with sudo -l.
What is the equivalent of sudo on CentOS, RHEL, or Fedora?
RHEL-family systems normally use the wheel group. Add the account with usermod -aG wheel username, then reconnect. The image must also contain a sudoers rule that authorizes wheel; membership alone is not proof of access.
Why does the new user still say “not in the sudoers file”?
Check that the expected group appears in id username, open a completely new SSH session, and confirm that /etc/sudoers or an included file grants that group permission. If the group is present but access remains denied, inspect and correct the policy with visudo.
Do I have to give the new user a password if I use an SSH key?
Not necessarily. A public key in authorized_keys can provide SSH authentication, while the local password and sudo password prompts are controlled separately by the image’s policy. Set a password only when your login or sudo policy requires one.
How do I edit sudoers safely?
Use sudo visudo -f /etc/sudoers.d/username for a user-specific rule, or the distribution’s validated editor for the main file. visudo checks syntax. Keep the existing privileged session open and run sudo -l from the target account after saving.
What should I do if sudo is not installed?
Use the provider console or an existing root session to install the distribution’s sudo package with its supported package manager. Package names and repositories vary by image. Reconnect after installation and test with sudo -l.
When can I disable direct root SSH login?
Only after a second terminal can log in as the named user with the intended key, id shows the expected group, and sudo -l confirms the required permissions. Keep a console or other recovery path available while changing SSH settings.
How do I diagnose public-key permission errors?
Verify the matching private key, an unwrapped key line in authorized_keys, ownership by the target user, mode 700 on .ssh, mode 600 on the key file, and traversal permissions on the home path. Follow SSH events with journalctl -fu ssh.service while making another test connection.
The Bottom Line
Keep the original administrator session open, create a named account, use sudo or wheel according to the distribution, and reconnect before testing. Confirm the actual policy with sudo -l, validate sudoers changes with visudo, and harden root or password access only after the new SSH path works.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
