The goal and the order of steps
Administrators should log in under their own accounts with keys and use sudo when needed, because this leaves a record of who did what and limits password guessing. The order matters: first make the new access work, test it, and restrict root as the last step. Keep the provider console available in case something goes wrong.
Create the account and install the key
Create the account, add its public key and set the permissions strictly, because sshd ignores key files that others can write to. Never copy a private key to the server. On Red Hat family systems use the wheel group instead of sudo.
sudo adduser admin1
sudo usermod -aG sudo admin1
sudo install -d -m 700 -o admin1 -g admin1 /home/admin1/.ssh
sudo install -m 600 -o admin1 -g admin1 ~/admin1.pub /home/admin1/.ssh/authorized_keysTest it from a second window
Keep your current session open and test the new login from another terminal. Being in a group does not by itself prove that sudo works, because the rules in sudoers decide that. Confirm it with sudo -l.
ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 admin1@server.example
sudo -l
sudo -vRestrict root login
PermitRootLogin prohibit-password allows root only with a key, and no blocks root over SSH completely. Put the change in its own file under /etc/ssh/sshd_config.d. For most options sshd uses the first value it finds, so an earlier file may win. For that reason verify the effective value with sshd -T instead of reading the files. Test a new login before you close the old session.
echo 'PermitRootLogin no' | sudo tee /etc/ssh/sshd_config.d/50-root.conf
sudo sshd -t
sudo systemctl reload ssh
sudo sshd -T | grep -iE '^(permitrootlogin|passwordauthentication) 'Password login and what to avoid
Turn off PasswordAuthentication only after every account you need has a tested key. Avoid sharing one account between several people, because then you cannot revoke one person without affecting the others. Passwordless sudo for a whole account also means that a stolen key alone gives full control.
Accounts in CH-J Server Manager
The Users module manages accounts, groups, SSH keys and SSH access over an active SSH session. It never changes sudoers or sets NOPASSWD, and it reports the actual sudo state from sudo -l. The root account cannot be deleted, and allowing root login with a password needs an extra confirmation, with Key only as the recommended choice. A change to SSH access is verified with sshd -T and a new SSH login, and the previous configuration returns automatically if the check fails or you would be locked out. Without sudo, the module is read-only.