Root can do anything, including the things you did not mean. There is no confirmation, no undo, and afterwards the log says root did it - which tells you nothing if more than one person has the password.

Make a named user

sudo adduser sara\nsudo usermod -aG sudo sara        # Debian and Ubuntu\n# sudo usermod -aG wheel sara     # RHEL, Alma and Rocky

Give it your key, then test before you close anything

sudo mkdir -p /home/sara/.ssh\nsudo cp ~/.ssh/authorized_keys /home/sara/.ssh/\nsudo chown -R sara:sara /home/sara/.ssh\nsudo chmod 700 /home/sara/.ssh\nsudo chmod 600 /home/sara/.ssh/authorized_keys
Open a second terminal and log in as the new user BEFORE you disable root or close the first session. A typo in a key file is recoverable while you still have a session, and a support call when you do not.

Then close the root door

# /etc/ssh/sshd_config\nPermitRootLogin no\nPasswordAuthentication no\n\nsudo sshd -t && sudo systemctl reload ssh

What sudo gives you that root does not

  • Every command is logged with the name of the person who ran it.
  • A dangerous command needs a deliberate five extra characters, which is enough to catch some of them.
  • Access is removed by taking one account out of one group, not by changing a password everybody shares.

Passwordless sudo, carefully

Automation needs sudo without a prompt. Scope it to the commands it actually runs rather than to everything.

# sudo visudo -f /etc/sudoers.d/deploy\ndeploy ALL=(root) NOPASSWD: /bin/systemctl reload nginx, /bin/systemctl restart app
Never edit /etc/sudoers with a plain editor. visudo checks the syntax before saving, and a broken sudoers file locks everybody out of sudo at once.