Create the accounts

useradd -m -u 1000 -G wheel -c "Administrator" admin
useradd -m -c "Daily driver" user

-m creates the home directory, -u 1000 pins admin to the first ordinary UID, and -G wheel puts it in the group sudo recognises. user takes the next UID on its own and joins no groups but its own.

id admin
id user

uid=1000(admin) gid=1000(admin) groups=1000(admin),998(wheel)
uid=1001(user) gid=1001(user) groups=1001(user)

The shell is /usr/bin/bash for both, from /etc/default/useradd. Note that this is not the zsh you have been typing into – that belongs to the live system, and the installed system has only what you installed.

Set the passwords

passwd root
passwd admin
passwd user

All three matter, for different reasons. admin and user are login accounts. The root password is the one people skip, and it is what systemd’s emergency and rescue targets ask for when something goes wrong at boot – without it, a machine that fails to mount its root leaves you with a prompt you cannot answer.

Root cannot log in over SSH regardless; that gets switched off on the next page.

Grant passwordless sudo

sudo reads drop-in files from /etc/sudoers.d, which is safer than editing /etc/sudoers itself: a syntax error in one small file is easier to find and undo.

install -m 0440 /dev/null /etc/sudoers.d/10-admin
echo "admin ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/10-admin

install -m 0440 creates the file with the permissions sudo insists on before it will read it. Then check the whole configuration parses – including the file you just wrote:

visudo -c

/etc/sudoers: parsed OK
/etc/sudoers.d/10-admin: parsed OK