What privliges should i give to a standard account? what should i remove? The user i am changing was the original Main admin account. I have set up a second account that will be my new main admin that will be added to all groups.
Edit:I already know how to change the user to standard, i was wondering what groups the standard user should be allowed into?
after add user for setup privilage do bellow guid first setup your favorit edittor for open sudoconfiguration file
sudo update-alternatives --config editor
after setup favorite edditor open sudo configuration with sudo visudo
find line with like this content # User privilege specification and add similar demo ALL=(ALL:ALL) ALL
The first field indicates the username that the rule will apply to (demo).
demo ALL=(ALL:ALL) ALL
The first "ALL" indicates that this rule applies to all hosts.
demo ALL=(ALL:ALL) ALL
This "ALL" indicates that the demo user can run commands as all users.
demo ALL=(ALL:ALL) ALL
This "ALL" indicates that the demo user can run commands as all groups.
demo ALL=(ALL:ALL) ALL
The last "ALL" indicates these rules apply to all commands.
demo ALL=(ALL:ALL) ALL
Names beginning with a "%" indicate group names.
There are a number of ways that you can achieve more control over how sudo reacts to a call.
The updatedb command associated with the "mlocate" package is relatively harmless. If we want to allow users to execute it with root privileges without having to type a password, we can make a rule like this:
GROUPONE ALL = NOPASSWD: /usr/bin/updatedb
NOPASSWD is a "tag" that means no password will be requested. It has a companion command called PASSWD, which is the default behavior. A tag is relevant for the rest of the rule unless overruled by its "twin" tag later down the line.
For instance, we can have a line like this:
GROUPTWO ALL = NOPASSWD: /usr/bin/updatedb, PASSWD: /bin/kill
Another helpful tag is "NOEXEC", which can be used to prevent some dangerous behavior in certain programs.
For example, some programs, like "less", can spawn other commands by typing this from within their interface:
!command_to_run This basically executes any command the user gives it with the same permissions that "less" is running under, which can be quite dangerous.
To restrict this, we could use a line like this:
username ALL = NOEXEC: /usr/bin/less
If you are simply wondering what kind of privileges are defined for your username, you can type:
sudo -l
