diff --git a/site-cookbooks/kosmos-base/recipes/default.rb b/site-cookbooks/kosmos-base/recipes/default.rb
index fb12b80..40bbac8 100644
--- a/site-cookbooks/kosmos-base/recipes/default.rb
+++ b/site-cookbooks/kosmos-base/recipes/default.rb
@@ -60,25 +60,7 @@ package "vim"
 # Don't create users and rewrite the sudo config in development environment.
 # It breaks the vagrant user
 unless node.chef_environment == "development"
-  # Searches data bag "users" for groups attribute "sysadmin".
-  # Places returned users in Unix group "sysadmin" with GID 2300.
-  users_manage "sysadmin" do
-    group_id 2300
-    action %i[remove create]
-  end
-
-  sudo "sysadmin" do
-    groups "sysadmin"
-    nopasswd true
-    defaults [
-      # not default on Ubuntu, explicitely enable. Uses a minimal white list of
-      # environment variables
-      "env_reset",
-      # Send emails on unauthorized attempts
-      "mail_badpass",
-      'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"'
-    ]
-  end
+  include_recipe "kosmos-base::users"
 
   include_recipe "kosmos-base::firewall"
 
diff --git a/site-cookbooks/kosmos-base/recipes/users.rb b/site-cookbooks/kosmos-base/recipes/users.rb
new file mode 100644
index 0000000..5fd768c
--- /dev/null
+++ b/site-cookbooks/kosmos-base/recipes/users.rb
@@ -0,0 +1,24 @@
+#
+# Cookbook Name:: kosmos-base
+# Recipe:: default
+#
+
+# Searches data bag "users" for groups attribute "sysadmin".
+# Places returned users in Unix group "sysadmin" with GID 2300.
+users_manage "sysadmin" do
+  group_id 2300
+  action %i[remove create]
+end
+
+sudo "sysadmin" do
+  groups "sysadmin"
+  nopasswd true
+  defaults [
+    # not default on Ubuntu, explicitely enable. Uses a minimal white list of
+    # environment variables
+    "env_reset",
+    # Send emails on unauthorized attempts
+    "mail_badpass",
+    'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"'
+  ]
+end