Create a sudo user

Use root only to create the administrator account. Daily work should happen through a regular user that elevates one command at a time with sudo.

While logged in as root, create the account and add it to Ubuntu’s sudo group:

adduser deploy
usermod -aG sudo deploy
id deploy

id deploy should list the sudo group. The password created by adduser protects local sudo use. SSH will continue to use the key.

Copy the working authorized key and give the new account ownership:

rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

Inspect the result:

namei -l /home/deploy/.ssh/authorized_keys

Every directory in the path must allow deploy to reach the file, while .ssh and authorized_keys must not be writable by unrelated users.

Keep the root session open. From a second local terminal, connect as the new user:

ssh -i ~/.ssh/digitalocean_notes deploy@203.0.113.10
sudo whoami

The first command should open a shell as deploy. The second should print root after the password prompt. Also run sudo -l to see the privileges granted through the group.

Wrong ownership is the most common failure here. SSH may ignore a key file that another user can modify. Repair ownership from the still-open root session:

chown -R deploy:deploy /home/deploy/.ssh

Do not close the original root connection until both key login and sudo work in a new session. If you do get locked out, use the DigitalOcean recovery console to repair the account rather than enabling weak remote authentication.

Your action is to complete the second-login test, then run whoami, groups, and sudo whoami and explain why all three outputs are different.