Not everything should run as root.
WHY IT MATTERS
Root can do anything, including destroying the system with a mistyped command. Working as a normal user with sudo means destructive actions require deliberate escalation.
It also means each person has an identifiable account, so you can see who did what.
CREATING A USER
Create the account, set a password, and add it to the group that grants sudo access. The group name differs by distribution: sudo on Debian and Ubuntu, wheel on Rocky and AlmaLinux.
Install that user's SSH public key.
GRANTING SUDO
Membership of the appropriate group is usually sufficient. For finer control, sudo can be configured to permit specific commands only.
FOR APPLICATIONS
Web applications should run as a dedicated unprivileged user, not as root. A compromised application then has limited reach.
FOR OTHER PEOPLE
Each developer or administrator gets their own account and their own key. Remove the account when they leave, which is a single action rather than a password change everyone must learn.
NEVER
Share the root password. Use SSH keys and sudo instead.
