sudo on your VPS no longer asks for a password

New VPSes come up with a candor sudo user instead of a root login. That user was being asked for a password every time it ran sudo — and the password was a random string you had to go and fetch from the portal, which is not a security control so much as a reason to give up and use root.

It now runs sudo without prompting, the same as the default account on every mainstream cloud image. Your SSH key is the credential that matters; once you’re on the box, sudo gets out of the way. The password still exists for recovering the account from the provider console, and root over SSH stays off.

This applies to servers built or reinstalled from now on. A server you set up earlier keeps asking until you reinstall it, or you can drop the prompt yourself with one line in /etc/sudoers.d/.