How do I limit administrative tasks for normal users?

Question

I want to limit administrative tasks, so users cannot mess up the system. My idea was to install Ubuntu, set up automatic login, and hand it to the users without them knowing the password. However, I now need to disable automatic login, and let the users lock their screen too, but if I give them the password for these task, they will also be able to manage the system.

So, is there any way to set different passwords for administrative tasks (updates, installations, sudo) and session tasks (login, lock screen, etc)?

Answer 1

Only users that have an "Administrator" account can use sudo, other users can't. By default only the first user (created during install) has "Administrator" rights. You can also change the account type at any time using the configuration panel for user accounts (but of course only a user with an "Administrator" account can change it ;) ).

Technical implementation detail: Ubuntu uses membership of the usergroup admin to determine if a user has "administrator rights".

Answer 2

You could create your own user and put yourself in the admin group (the group used for administrating the box), then remove the other user from that group.

I don't see why you need to keep it to a single account. This is the basic reason for using multiple accounts (permissions)

Answer 3

Remove your users from the admin group. Give them their passwords. They will be able to login and lock their screens, but will not be able to modify the system through updates or installing system-wide programs.

The following shell excerpt removes the user djeikyb from the admin group.

id shows information about a user. The n and G options make the command print the names of the groups the user is in.

usermod with G option lets you specify what groups you want a user in. I just copied and pasted the id -nG output and added commas in between each group name. The user you want to affect is named at the very end of the command.

$ id -nG djeikyb
djeikyb adm dialout cdrom audio video plugdev admin
$ usermod -G djeikyb,adm,dialout,cdrom,audio,video,plugdev djeikyb
$ id -nG djeikyb
djeikyb adm dialout cdrom audio video plugdev