How to create a group which is allowed to use the adduser command?

Question

Does anyone know the commands for each step listed below?

1. Create a new sudoers group called privilege1 allowing the use of the adduser command and nothing more. The sudoers configuration file is located at /etc/sudoers
2. Now create a new user called user1 with the adduser command.
3. Then add user user1 to the sudoers privilege1 group to the /etc/sudoers file.
4. The final step is to test if that user user1 can now use the adduser command.

Answer 1

Allowing users to use adduser is no good since you'll also be able to assign random groups to this user. In Ubuntu, the group admin allows users to run commands as root. So, I suggest you adding the user to the admin group anyway since the other way requires just one step more to become root.

These insecure steps would allow you to become root:

you@host:~$ sudo adduser --ingroup admin user1
..
you@host:~$ su - user1
..
user1@host:~$ id -Gn
admin
user1@host:~$ sudo id
uid=0(root) gid=0(root) groups=0(root)

Oops! You've just granted root access to an account where you wanted to limit the user on creating accounts only! Of course you can limit the command arguments, but user management should be considered an administrative task which should only be performable by root. Therefore, just add an user to the admin group if you want to allow the user to use sudo for executing commands as root:

sudo usermod -a -G admin name-of-existing-user