How to configure user accounts and root access on a server

Objective

With the delivery of an OVHcloud dedicated server or a VPS, you will gain "root access" to your service. In basic terms, this means that you are the system's administrator and have the highest permission level on it.

Even if the server is not used for a purpose that requires the administration of actual users, managing user accounts is a security-related topic that should not be underestimated. This guide provides basic advice to get started with the following topics:

• How to configure system user accounts with different permission levels
• Best practices to manage access to your server and execute commands with elevated permissions

Requirements

• A dedicated server or a VPS with a Linux-based OS in your OVHcloud account
• Login credentials received via email after the installation

Instructions

The following examples presume that you are connected to your server via SSH.
For more detailed instructions on this topic, please refer to our guide "Getting started with SSH".

Be sure to consult our "Getting started" guides as well:

• For a dedicated server
• For a dedicated server of the Eco product line
• For a VPS

Content overview

• User account management
  • Creating an unprivileged user account
  • Creating a user account with root privileges
  • Executing commands as an administrator ("sudo")
  • Disabling a user account
  • Enabling a user account
  • Deleting a user account
  • Switching user accounts
  • Switching to the "root" account ("root shell")
• Activating login for the user "root"
  • Enabling the "root" account
  • Editing the file "sshd_config"
  • Restarting the SSH service

User account management

Note that server security policies can be adjusted to different use cases and user environments. The steps described below offer basic explanations about user account management with a focus on convenience and security and do not claim universal validity.

After a new installation of your server (with an OVHcloud template), you start with these conditions:

• A user account with elevated permissions is created and named after the operating system, for example "ubuntu", "rocky", etc.
• You have received the initial password for this account with your installation email.
• You can use an SSH client to log on to the server with these credentials.

The command prompt after login will vary, depending on your service type and the distribution installed, for example:

ubuntu@ns9356771:~$

Note that the command line examples below will keep using "ubuntu" to refer to the preconfigured user account.

You can see in the output of the following command that this account is already added to the sudo group:

id

27(sudo)

You can also enter groups to only see the groups the current user account is a member of.

This means that the user you are currently logged in with can execute all commands by preceding them with the sudo command (root privileges). You can find more detailed information in the corresponding guide section below.

Creating an unprivileged user account

Even if you do not need to grant other persons access to your server, creating a user account without any special permissions (possibly referred to as normal user or regular user as well) can be useful for security purposes. For example, there is no danger of accidentally damaging the system by deleting or altering server configuration files when executing commands or processes from a user account without elevated permissions.

Another best practice example is to create a user account dedicated to an application hosted on your server. Even if the user account becomes compromised through this application, the lack of elevated permissions will prevent greater harm.

Create a new user account (replace username with the actual name of the user account, for example the name of an application):

sudo adduser username

You have to provide a password for the new account. Then you are prompted to enter details for the new user, which is optional.

New password: 
Retype new password:
passwd: password updated successfully

Note: On a GNU/Linux distribution, a password prompt will not display your keyboard inputs.

• Relevant man pages: adduser, useradd

Creating a user account with root privileges

In this section, a new user account for an administrator is created and granted elevated permissions on the server (root privileges).

Create a new user account (replace username with the actual name of the user account):

sudo adduser username

Add the new user account to the sudo group:

sudo usermod -aG sudo username

You can verify group membership with the following command:

groups username

Example:

groups ubuntu

ubuntu sudo users

The new user account is now a sudo user and can execute all commands.

This is configured by the default setting for the sudo group:

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

The corresponding configurations can be found in /etc/sudoers and the directory /etc/sudoers.d respectively.

Executing commands as an administrator ("sudo")

Any action that requires elevated permissions will be rejected unless the sudo command is used.

For example, to change a password for any user account, type sudo passwd followed by the username:

sudo passwd ubuntu

New password: 
Retype new password:
passwd: password updated successfully

The system will frequently ask for the password of the sudo user you are logged in as when executing sudo.

• Relevant man pages: sudo_root, sudo, sudoers

Disabling a user account

To disable a user account, enter:

sudo passwd -dl username

This will lock the account (i.e. prevent logging in via password) and set it "passwordless", effectively disabling the account.

Enabling a user account

To reenable a passwordless locked user account, use the following commands (replace initialpassword with a temporary password):

sudo usermod username -p initialpassword

sudo passwd -u username

For security reasons, change the initial password for this user again:

sudo passwd username

• Relevant man pages: passwd, usermod

Deleting a user account

A simple method to remove an account and its files is the following command:

sudo userdel -r -f username

• Relevant man pages: userdel, deluser

Switching user accounts

As a sudo user, you can switch to any other user account (without having to know the password):

sudo su username

Your command prompt will change accordingly:

ubuntu@ns9356771:~$ sudo su username
username@ns9356771:/home/ubuntu$

To return to your previous user account, switch again or use exit.

Switching to the "root" account ("root shell")

After a new installation of your server (with an OVHcloud template), the root account (user account named root) can be used but it has no password.

For security reasons, the root account should only be used when required and it should only be accessed from the system itself.

You can switch to the root account with the following command:

sudo -s

Your command prompt will change accordingly:

ubuntu@ns9356771:~$ sudo -s
root@ns9356771:/home/ubuntu#

The character # at the end of the command prompt indicates a root shell, as opposed to a prompt ending with $.

Use the following command to return to the previous user account:

exit

Executing commands as the root user is usually not necessary and may even be counterproductive.

A common misconception is the assumption that you need to use the actual root account in order to execute commands that require elevated permissions (root privileges) on a system.

However, as configured by default in the /etc/sudoers policy, the permission level of root is identical to the one of the sudo group:

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# User privilege specification
root    ALL=(ALL:ALL) ALL

Activating login for the user "root"

Step 1: Enable the "root" account

Enter the following command, then provide a password at the prompt:

sudo passwd root

You can undo this action by entering:

sudo passwd -d root

Step 2: Edit the file "sshd_config"

Use a text editor such as vim or nano to edit this configuration file:

sudo nano /etc/ssh/sshd_config

You can find the following line:

#PermitRootLogin prohibit-password

The leading character # turns the entire line into a "comment" string and it is therefore disregarded by any application reading the file.

This means that if there is no other instruction, logging in with the user account root is not enabled.

Add the following line:

PermitRootLogin yes

This will allow server logins with root and the corresponding password.

Save the file and exit the editor. To revoke this type of access, repeat the steps and remove the line.

Step 3: Restart the SSH service

Restart the SSH service with one of the following commands:

sudo systemctl restart ssh

sudo systemctl restart sshd

This should be sufficient to apply the changes. Otherwise reboot the server from the command line (sudo reboot).

Go further

Securing a dedicated server

Securing a VPS

Join our community of users.