Users, groups, and sudo

On a Linux VPS, users and groups control who can sign in and which files they can reach. The sudo command lets a normal account run selected tasks as root without staying logged in as root all day. That setup keeps a clearer audit trail and limits damage if a key or laptop is compromised. Shared cPanel hosting is a different story: you already work inside one jailed account and do not manage system users this way.

On a VPS, create one account per person who needs access. Keeping the default ubuntu or centos login forever makes it hard to see who did what after a contractor leaves. Add a separate deploy user when continuous integration only needs to restart a service. Groups such as docker and wheel are convenient and wide, so prefer a narrow deploy account when the job is limited.

What sudo actually grants

A line in /etc/sudoers or a drop-in under /etc/sudoers.d/ states which user may run which command as which other user. The rule ALL=(ALL) ALL means that person becomes root after entering a password. That is fine for the human who owns the server. It is not a good fit for a bot or CI job.

The common trap is NOPASSWD:ALL on a deploy user that still has a shell. A leaked CI token then equals full root with no password prompt and no person in the loop. Scope the sudoers line to the exact systemctl commands that account needs. Remove the shell if the account exists only to restart a unit such as php-fpm.

How you confirm the model works

SSH in as the named user rather than as root. Run sudo -l to print the commands you are allowed to run. Use sudo -k to clear a cached timestamp so the next command asks for a password again. Once the named user can use sudo, set PermitRootLogin no in the SSH daemon config. Keep a working out-of-band console path tested so a sudoers typo remains recoverable.

Edit sudoers only with visudo. A naked echo or redirect can leave a syntax error and lock sudo until you recover from the console. On shared cPanel hosting you will not usefully hunt for this file, because the account is already isolated for you.

Practical habits on a VPS

Your VPS includes root access, so you own these files and the choices that go with them. Create the named user, place it in the sudo group, install a public key for SSH, and keep a password on sudo when a person is at the keyboard. That short pause before a destructive command is intentional. Prefer a deploy user that can only restart the unit it owns instead of granting broad group membership by default.