Creating a new sudo user on AlmaLinux

Running everything as root is a bad habit, even on your own VPS. Creating a separate user with sudo access costs you thirty seconds and means every privileged command you run is logged against a named account rather than lost in root’s history. Here’s how to set one up on AlmaLinux.

1. Create the user

Log in as root (or an existing sudo user) and create the new account:

sudo useradd yourusername

useradd creates the account, its home directory, and a matching primary group, but it doesn’t set a password or grant any special privileges yet – that’s the next two steps.

2. Set a password

sudo passwd yourusername

You’ll be prompted to enter and confirm a password for the new account. Use a strong one – if you’re planning to disable SSH password login afterwards (which you should), this password will still be used for local `sudo` prompts, so it’s not something to skip or leave weak.

3. Add the user to the wheel group

This is the step that actually grants sudo access, and it’s the part that trips people up if they’re coming from Debian or Ubuntu. On those distributions, sudo access is controlled by membership of a group called sudo. AlmaLinux, like every RHEL-family distribution, doesn’t use that group at all – it uses a group called wheel instead. The /etc/sudoers file on AlmaLinux already contains a rule granting full sudo access to anyone in wheel, so adding a user to that group is all you need to do.

sudo usermod -aG wheel yourusername

The flags matter here: -a means “append” and -G specifies the group to add. If you leave out -a, usermod will replace the user’s existing group memberships with just the one you specify, which usually isn’t what you want.

4. Verify it worked

Check the user is actually in the group:

groups yourusername

You should see wheel listed alongside their primary group. Then switch to that user and confirm sudo actually works:

su - yourusername
sudo whoami

sudo whoami should prompt for the user’s password and then print root. If it does, the account has working sudo access.

If sudo still refuses the user with a “not in the sudoers file” error immediately after adding them to the group, log the user out and back in – group membership is only picked up at login, so an already-open session won’t see the change until it’s refreshed. Running newgrp wheel also works as a quick fix within an existing session.

Next steps

Once your sudo user is working, set up key-based SSH login for it and disable root login over SSH entirely. Both are covered in our initial server setup checklist.