Creating Users and Granting sudo Privileges on Ubuntu 26.04 LTS Server

How to Create Users and Configure sudo Privileges

This article explains how to create a regular user on Ubuntu 26.04 LTS Server and how to grant or revoke the sudo privileges needed to run administrative commands. On Ubuntu, root has no password and cannot log in directly, so administrative work is done by a regular user prefixing commands with sudo.

The examples in this article log in as the initial user kazulog created by cloud-init and create a new user named taro.

Starting with Ubuntu 25.10, sudo is sudo-rs, a rewrite in Rust (this article was tested with sudo-rs 0.2.13). Basic usage and the /etc/sudoers syntax are the same as the traditional sudo, but some screen output differs: the password prompt reads [sudo: authenticate] Password: and typed characters are shown as *.

Checking the Current User and sudo Privileges

The id command shows the logged-in user and the groups they belong to. A user who is a member of the sudo group (GID 27) can run sudo.

Command to check the user and group membership
id

Example: checking the user and group membership
kazulog@sv1:~$ id
uid=1000(kazulog) gid=1000(kazulog) groups=1000(kazulog),4(adm),24(cdrom),27(sudo),30(dip),102(lxd)
kazulog@sv1:~$

sudo -l lists the commands you are allowed to run with sudo.

Command to list the commands allowed with sudo
sudo -l

Example: listing the commands allowed with sudo
kazulog@sv1:~$ sudo -l
User kazulog may run the following commands on sv1:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: ALL
kazulog@sv1:~$

In the example above, the sudo group rule ((ALL : ALL) ALL) is in effect together with the password-less rule ((ALL) NOPASSWD: ALL) that cloud-init wrote to /etc/sudoers.d/90-cloud-init-users.

Creating a User (adduser Command)

Command to create a user
sudo adduser [NAME]

Field	Value
[NAME]	Name of the user to create

adduser is interactive: it asks for a password and then for the full name and other details. Everything after the full name can be skipped by pressing Enter.

Example: creating a user
kazulog@sv1:~$ sudo adduser taro
New password: 
Retype new password: 
passwd: password updated successfully
Changing the user information for taro
Enter the new value, or press ENTER for the default
	Full Name []: Taro Yamada
	Room Number []: 
	Work Phone []: 
	Home Phone []: 
	Other []: 
Is the information correct? [Y/n] Y
kazulog@sv1:~$

The example above creates the user taro. The home directory /home/taro is created and the login shell is /bin/bash.

adduser is interactive, so it cannot be used where no interaction is possible, such as inside a script. Use useradd, described next, in those cases.

Use id or getent passwd to check the new user.

Example: checking the created user
kazulog@sv1:~$ id taro
uid=1001(taro) gid=1001(taro) groups=1001(taro),100(users)
kazulog@sv1:~$ getent passwd taro
taro:x:1001:1001:Taro Yamada,,,:/home/taro:/bin/bash
kazulog@sv1:~$ ls -ld /home/taro
drwxr-x--- 2 taro taro 4096 Sep 10 13:31 /home/taro
kazulog@sv1:~$

Creating a User in One Line (useradd Command)

useradd is a non-interactive command: with the right options, it creates a user in a single line. Use it when running from a script or when creating several users at once.

Command to create a user (useradd)
sudo useradd -m -s /bin/bash -c "[COMMENT]" -G [GROUP] [NAME]

Option	Description
`-m`	Creates the home directory (not created without this option)
`-s`	Sets the login shell (defaults to `/bin/sh` without this option)
`-c`	Sets the comment field (full name and so on)
`-G`	Adds supplementary groups (specifying `sudo` grants sudo privileges at creation time)
[NAME]	Name of the user to create

useradd does not set a password, so set one with passwd, or pass user:password to chpasswd to set it in one line.

Command to set a password in one line
echo '[NAME]:[PASSWORD]' | sudo chpasswd

Example: creating a user with useradd and chpasswd
kazulog@sv1:~$ sudo useradd -m -s /bin/bash -c 'Hanako Suzuki' -G sudo hanako
kazulog@sv1:~$ id hanako
uid=1001(hanako) gid=1001(hanako) groups=1001(hanako),27(sudo)
kazulog@sv1:~$ getent passwd hanako
hanako:x:1001:1001:Hanako Suzuki:/home/hanako:/bin/bash
kazulog@sv1:~$ ls -ld /home/hanako
drwxr-x--- 2 hanako hanako 4096 Sep 10 13:57 /home/hanako
kazulog@sv1:~$ sudo passwd -S hanako
hanako L 2026-09-10 0 99999 7 -1
kazulog@sv1:~$ echo 'hanako:hanako-pass-2026' | sudo chpasswd
kazulog@sv1:~$ sudo passwd -S hanako
hanako P 2026-09-10 0 99999 7 -1
kazulog@sv1:~$ su - hanako
Password: 
hanako@sv1:~$ id
uid=1001(hanako) gid=1001(hanako) groups=1001(hanako),27(sudo)
hanako@sv1:~$ sudo whoami
[sudo: authenticate] Password: ****************                
root
hanako@sv1:~$ exit
logout

Until a password is set, the second column of passwd -S stays L (locked) and the user cannot log in. In the example above it changes to P after chpasswd sets the password.

Note that plain sudo useradd [NAME] with no options creates no home directory and sets the login shell to /bin/sh. Do not forget -m and -s.

Example: running useradd without options
kazulog@sv1:~$ sudo useradd jiro
kazulog@sv1:~$ getent passwd jiro
jiro:x:1001:1001::/home/jiro:/bin/sh
kazulog@sv1:~$ sudo passwd -S jiro
jiro L 2026-09-10 0 99999 7 -1
kazulog@sv1:~$ ls -ld /home/jiro
ls: cannot access '/home/jiro': No such file or directory
kazulog@sv1:~$

To delete a user created this way, use userdel -r (with -r the home directory is removed as well, the same as deluser --remove-home).

Example: deleting a user created with useradd
kazulog@sv1:~$ sudo userdel -r hanako
userdel: hanako mail spool (/var/mail/hanako) not found
kazulog@sv1:~$ id hanako
id: 'hanako': no such user
kazulog@sv1:~$ ls -ld /home/hanako
ls: cannot access '/home/hanako': No such file or directory

Granting sudo Privileges (Adding to the sudo Group)

To allow the new user to run administrative commands, add the user to the sudo group.

Command to grant sudo privileges
sudo usermod -aG sudo [NAME]

Field	Value
[NAME]	Name of the user to grant sudo privileges to

If you forget the -a (append) option, the user is removed from every supplementary group other than the sudo group you specified (such as adm and users; the primary group is kept). Always use the -aG form.

Example: granting sudo privileges
kazulog@sv1:~$ sudo usermod -aG sudo taro
kazulog@sv1:~$ id taro
uid=1001(taro) gid=1001(taro) groups=1001(taro),27(sudo),100(users)
kazulog@sv1:~$

The new group membership takes effect at the next login. Log in again with su - [NAME] and confirm with sudo -l and sudo whoami.

Example: verifying sudo privileges
kazulog@sv1:~$ su - taro
Password: 
taro@sv1:~$ id
uid=1001(taro) gid=1001(taro) groups=1001(taro),27(sudo),100(users)
taro@sv1:~$ sudo -l
[sudo: authenticate] Password: **************              
User taro may run the following commands on sv1:
    (ALL : ALL) ALL
taro@sv1:~$ sudo whoami
root
taro@sv1:~$ exit
logout
kazulog@sv1:~$

If sudo whoami prints root, the sudo privileges were granted correctly. Note that after authenticating once with sudo -l, sudo does not ask for the password again for a while, which is why the following sudo whoami shows no prompt.

Revoking sudo Privileges (Removing from the sudo Group)

Command to revoke sudo privileges
sudo gpasswd -d [NAME] sudo

Field	Value
[NAME]	Name of the user to revoke sudo privileges from

Example: revoking sudo privileges
kazulog@sv1:~$ sudo gpasswd -d taro sudo
Removing user taro from group sudo
kazulog@sv1:~$ id taro
uid=1001(taro) gid=1001(taro) groups=1001(taro),100(users)
kazulog@sv1:~$ su - taro
Password: 
taro@sv1:~$ sudo whoami
sudo: I'm sorry taro. I'm afraid I can't do that
taro@sv1:~$ exit
logout
kazulog@sv1:~$

The example above revokes sudo privileges from taro. Running sudo afterwards is rejected without a password prompt with the message sudo: I'm sorry taro. I'm afraid I can't do that (the traditional sudo printed taro is not in the sudoers file).

Running sudo Without a Password

For automation scripts and similar cases where sudo must run without a password prompt, add a configuration file under /etc/sudoers.d/. Do not edit /etc/sudoers itself; create the file with visudo, which checks the syntax for you.

Command to create a sudoers configuration file
sudo visudo -f /etc/sudoers.d/[NAME]

Field	Value
[NAME]	User the rule applies to (the file name is arbitrary, but files whose name contains a `.` or ends with `~` are not read)

An editor (nano by default) opens. Enter the following line and save the file.

Rule that allows sudo without a password
[NAME] ALL=(ALL) NOPASSWD:ALL

To write a single line without opening an editor, you can also feed it to visudo from standard input. The examples below created the file this way.

Command to create a sudoers configuration file from standard input
echo 'taro ALL=(ALL) NOPASSWD:ALL' | sudo EDITOR=tee visudo -f /etc/sudoers.d/taro

visudo -c checks the syntax of the sudoers files. Files under /etc/sudoers.d/ are checked as well, and an error is reported with the file name and line number.

Example: checking the syntax of the sudoers files
kazulog@sv1:~$ sudo visudo -c
/etc/sudoers: parsed OK
kazulog@sv1:~$ sudo ls -l /etc/sudoers.d/
total 12
-r--r----- 1 root root 141 Sep 10 13:30 90-cloud-init-users
-r--r----- 1 root root 863 Jan 15  2026 README
-rw-r----- 1 root root  28 Sep 10 13:31 taro
kazulog@sv1:~$ sudo cat /etc/sudoers.d/taro
taro ALL=(ALL) NOPASSWD:ALL
kazulog@sv1:~$

Example: running sudo without a password
kazulog@sv1:~$ su - taro
Password: 
taro@sv1:~$ sudo -l
User taro may run the following commands on sv1:
    (ALL) NOPASSWD: ALL
taro@sv1:~$ sudo whoami
root
taro@sv1:~$ exit
logout
kazulog@sv1:~$

NOPASSWD:ALL allows every command without a password. To allow only specific commands, list them with absolute paths instead of ALL (for example, taro ALL=(ALL) NOPASSWD:/usr/bin/systemctl restart nginx).

Changing a Password (passwd Command)

Use passwd to change your own password and sudo passwd [NAME] to change another user’s password. The example below also confirms with su - taro that the new password works.

Command to change a password
sudo passwd [NAME]

Field	Value
[NAME]	User whose password to change (defaults to yourself when omitted)

Example: changing a password
kazulog@sv1:~$ sudo passwd taro
New password: 
Retype new password: 
passwd: password updated successfully
kazulog@sv1:~$ su - taro
Password: 
taro@sv1:~$ whoami
taro
taro@sv1:~$ exit
logout
kazulog@sv1:~$

Deleting a User (deluser Command)

Command to delete a user
sudo deluser --remove-home [NAME]

Field	Value
[NAME]	Name of the user to delete

With --remove-home, the home directory is deleted as well. Without it, the user is deleted but the home directory remains. deluser prints nothing when it succeeds.

deluser does not remove a configuration file created under /etc/sudoers.d/, so delete it with rm first.

Example: deleting a user
kazulog@sv1:~$ sudo rm /etc/sudoers.d/taro
kazulog@sv1:~$ sudo visudo -c
/etc/sudoers: parsed OK
kazulog@sv1:~$ sudo deluser --remove-home taro
kazulog@sv1:~$ id taro
id: 'taro': no such user
kazulog@sv1:~$ ls -ld /home/taro
ls: cannot access '/home/taro': No such file or directory
kazulog@sv1:~$

About the root User

The root account exists on Ubuntu, but no password is set for it at installation time: the password field in /etc/shadow contains *, which matches no possible value. By default, therefore, you cannot log in directly as root with a password (at the console or with su -). This is what the L (locked) in the second column of passwd -S root means.

Example: checking the root password status
kazulog@sv1:~$ sudo passwd -S root
root L 2026-08-23 0 99999 7 -1
kazulog@sv1:~$ sudo grep '^root:' /etc/shadow
root:*:20688:0:99999:7:::
kazulog@sv1:~$ su -
Password: 
su: Authentication failure
kazulog@sv1:~$

To work with root privileges, start a root shell with sudo.

Command to start a root shell
sudo -i

Command	Behavior
`sudo -i`	Starts a login shell for root (the working directory changes to `/root`)
`sudo -s`	Starts a root shell that keeps your current working directory (no login processing; the home directory becomes `/root`)

Example: sudo -s and sudo -i
kazulog@sv1:~$ cd /tmp
kazulog@sv1:/tmp$ sudo -s
root@sv1:/tmp# whoami
root
root@sv1:/tmp# pwd
/tmp
root@sv1:/tmp# echo $HOME
/root
root@sv1:/tmp# exit
exit
kazulog@sv1:/tmp$ sudo -i
root@sv1:~# whoami
root
root@sv1:~# pwd
/root
root@sv1:~# echo $HOME
/root
root@sv1:~# exit
logout
kazulog@sv1:/tmp$

If you want to log in directly as root, set a root password with sudo passwd root. After that, passwd -S shows P, and you can log in as root at the console or with su -.

Command to set the root password
sudo passwd root

Example: setting the root password and logging in with su -
kazulog@sv1:~$ sudo passwd root
New password: 
Retype new password: 
passwd: password updated successfully
kazulog@sv1:~$ sudo passwd -S root
root P 2026-09-10 0 99999 7 -1
kazulog@sv1:~$ su -
Password: 
root@sv1:~# whoami
root
root@sv1:~# exit
logout
kazulog@sv1:~$

Working directly as root removes the record of who ran which command. Normally, leave the root password unset and work through sudo. Also note that setting a root password does not necessarily allow root logins over SSH; the SSH side is covered in Configuring the SSH Server on Ubuntu 26.04 LTS Server.

To return to the original state (lock the root password), run sudo passwd -l root.

Command to lock the root password
sudo passwd -l root

Example: locking the root password
kazulog@sv1:~$ sudo passwd -l root
passwd: password changed.
kazulog@sv1:~$ sudo passwd -S root
root L 2026-09-10 0 99999 7 -1
kazulog@sv1:~$ sudo grep '^root:' /etc/shadow
root:!$y$j9T$ZwiZAHFi9TMLave282yGC.$h.9O6DniClLZm3k/ot2dm8kKDhq6EbgbuhIIWiTUBvA:20706:0:99999:7:::
kazulog@sv1:~$ su -
Password: 
su: Authentication failure
kazulog@sv1:~$

passwd -l locks the account by prefixing the hash with !, so the password hash remains in /etc/shadow. To restore the * that a fresh installation has, run sudo usermod -p '*' root.

Test Environment and Session Logs

The examples in this article were captured on Ubuntu 26.04 LTS Server running on CML (cloud image, initial user kazulog created by cloud-init). The full session log of each step (from the first prompt to the last output line) can be downloaded below.

STEP	Operation	Session log
0	Checking the initial state	log
1	Creating the user (`adduser`)	log
11	Creating a user in one line (`useradd` + `chpasswd`) and deleting it (`userdel -r`)	log
11	Defaults of `useradd` without options	log
2	Granting sudo (`usermod -aG sudo`)	log
3	Revoking sudo (`gpasswd -d`)	log
4	sudo without a password (`/etc/sudoers.d/`)	log
5	Changing the password (`passwd`)	log
6	Deleting the user (`deluser --remove-home`)	log
7	Checking the root password status and `sudo -i`	log
8	`sudo -s` vs `sudo -i`, setting the root password and `su -`	log
9	Locking the root password (`passwd -l`)	log
10	Logging in as root with the `login` command and restoring `*`	log

Reference

Ubuntu Server documentation: User management