Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I want to limit administrative tasks, so users cannot mess up the system. My idea was to install Ubuntu, set up automatic login, and hand it to the users without them knowing the password. However, I now need to disable automatic login, and let the users lock their screen too, but if I give them the password for these task, they will also be able to manage the system.

So, is there any way to set different passwords for administrative tasks (updates, installations, sudo) and session tasks (login, lock screen, etc)?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

Remove your users from the admin group. Give them their passwords. They will be able to login and lock their screens, but will not be able to modify the system through updates or installing system-wide programs.

The following shell excerpt removes the user djeikyb from the admin group.

id shows information about a user. The n and G options make the command print the names of the groups the user is in.

usermod with G option lets you specify what groups you want a user in. I just copied and pasted the id -nG output and added commas in between each group name. The user you want to affect is named at the very end of the command.

$ id -nG djeikyb
djeikyb adm dialout cdrom audio video plugdev admin
$ usermod -G djeikyb,adm,dialout,cdrom,audio,video,plugdev djeikyb
$ id -nG djeikyb
djeikyb adm dialout cdrom audio video plugdev
share|improve this answer

Only users that have an "Administrator" account can use sudo, other users can't. By default only the first user (created during install) has "Administrator" rights. You can also change the account type at any time using the configuration panel for user accounts (but of course only a user with an "Administrator" account can change it ;) ).

Technical implementation detail: Ubuntu uses membership of the usergroup admin to determine if a user has "administrator rights".

share|improve this answer

You could create your own user and put yourself in the admin group (the group used for administrating the box), then remove the other user from that group.

I don't see why you need to keep it to a single account. This is the basic reason for using multiple accounts (permissions)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.