Users, groups and sudo done properly

Every person who logs in should have their own account. Shared accounts make it impossible to know who did what, and impossible to remove one person's access cleanly.

Creating an admin user

sudo adduser maria
sudo usermod -aG sudo maria

adduser is Debian and Ubuntu's friendly wrapper: it creates the home directory, asks for a password and copies default files. On other distributions you would use useradd -m. The sudo group grants administrative rights on Ubuntu; on RHEL based systems the equivalent group is wheel.

The -a in usermod -aG matters: without it, the user is removed from all other supplementary groups.

How sudo decides

sudo reads /etc/sudoers and files in /etc/sudoers.d/. Always edit with visudo, which checks syntax before saving. A broken sudoers file can lock everyone out of administrative access.

sudo visudo -f /etc/sudoers.d/deploy

# Allow the deploy user to restart only the app service, without a password
deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart orders-api.service

This grants one precise command instead of full root access, which is the principle of least privilege applied to sudo.

Service accounts

Applications should run as dedicated users with no login shell and no sudo:

sudo adduser --system --group --home /srv/orders --shell /usr/sbin/nologin orders

If the application is compromised, the attacker gets only that user's limited permissions.

Checking who has access

getent group sudo
sudo -l -U maria          # what can maria run with sudo?
lastlog | grep -v "Never"
last -n 20

Review these regularly and remove access when people leave:

sudo usermod -L olduser          # lock the password
sudo usermod -s /usr/sbin/nologin olduser
sudo rm /home/olduser/.ssh/authorized_keys

Locking first, deleting later, gives you time to recover files or audit what the account did.

The root account

Ubuntu disables direct root password login by default, and you should keep it that way. Use sudo for individual commands, and sudo -i for a root shell only when you need several administrative commands in a row. Every sudo command is logged, so you can see later who ran what.