0

I've been running a server with a few friends for a while, we all share the server, though I am the person who actually pays for the server.
I'm running all of my stuff as the root user.
(I know, it's a bad idea, and can cause unrecoverable damage, but it was the easiest thing for me to do when setting up the server, and if I want to go into someone elses files, I don't have to worry about permissions, and they can't get into my files by most methods)

I don't want ANY of the regular users to be able to get into the root user, or the /root directory without actually logging into root with the root account's password. I've got su - root disabled, but there's still sudo -i, sudo -s, and the ability to just sudo cp -R /root ~/rootStuff, I don't want them to be able to get into the actual root account, or the directory, all the really need to be able to do is work in their own home directories, and the stuff that's regularly accessible by everyone, /opt, /etc, etc.

don't want to fully take sudo away from all of them, since this means that anything they have to do around the server, like properly installing packages, will involve me, but if it's the best way, I can do that.
It's not like I don't trust the people I have on my server, I do, they're good friends, I just have some pretty sensitive stuff stored in /root.

The only commands they really need to be able to sudo are apt, and maybe some other random commands down the road, but I can deal with that when I get there.

The server's version is 18.04.3 LTS if that makes much of a difference. Also, the server is a dedicated server from a hosting company, I only have ssh, no physical access, or visual.

| improve this question | |
  • I'm aware of how permissions work. People can just gain root access using something like sudo -i, and go right in – Donovan_DMC Aug 15 '19 at 19:43
  • What, exactly, is the purpose of this server? Does it serve web/games/services? Is it storage? Collaboration space? Something else? – user535733 Aug 15 '19 at 20:24
  • The server is used for anything we all need really, it's currently mainly used for Discord Bots. – Donovan_DMC Aug 15 '19 at 21:46
0
  • First, create an account for your friend using adduser. Do not make your friend a member of the 'sudo' group. Let's pretend his user name is 'bob'

  • Give permission to sudo specific commands like this:

    • sudo visudo (or just visudo if you're already root)
    • add a line which looks like 'bob ALL= apt, apt-get'

What this means is user bob, from any terminal (ALL) can sudo the commands apt, and apt-get.

You'll also see bob ALL = (ALL) foo, bar on the net a lot, which means let bob run from ALL terminals as ALL users. I don't think there's any use to using apt as any other user anyway.

If you need to give your friend access to more programs, you can add more items with commas.

| improve this answer | |
  • I started poking around a little after i posted this, and found ways to allow access to most sudo commands, but deny using some specific arguments on them. Ex, not being able to start sudo ls with /root. Though since this is that I would have needed, I'l go ahead and mark it as correct. – Donovan_DMC Aug 16 '19 at 1:29
0

Give everybody their own LXD container, then lock them out of the host server.

Containers can look and feel like a complete system (except if you dig around the kernel), including SSH and apt. Each of your friends can have their own container, installing/removing/customizing whatever they like. It takes a fraction of the resources of a real VM.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.