How do I keep users on my server from accessing the root user?

Question

I've been running a server with a few friends for a while, we all share the server, though I am the person who actually pays for the server.
I'm running all of my stuff as the root user.
(I know, it's a bad idea, and can cause unrecoverable damage, but it was the easiest thing for me to do when setting up the server, and if I want to go into someone elses files, I don't have to worry about permissions, and they can't get into my files by most methods)

I don't want ANY of the regular users to be able to get into the root user, or the /root directory without actually logging into root with the root account's password. I've got su - root disabled, but there's still sudo -i, sudo -s, and the ability to just sudo cp -R /root ~/rootStuff, I don't want them to be able to get into the actual root account, or the directory, all the really need to be able to do is work in their own home directories, and the stuff that's regularly accessible by everyone, /opt, /etc, etc.

don't want to fully take sudo away from all of them, since this means that anything they have to do around the server, like properly installing packages, will involve me, but if it's the best way, I can do that.
It's not like I don't trust the people I have on my server, I do, they're good friends, I just have some pretty sensitive stuff stored in /root.

The only commands they really need to be able to sudo are apt, and maybe some other random commands down the road, but I can deal with that when I get there.

The server's version is 18.04.3 LTS if that makes much of a difference. Also, the server is a dedicated server from a hosting company, I only have ssh, no physical access, or visual.

Answer 1

• First, create an account for your friend using adduser. Do not make your friend a member of the 'sudo' group. Let's pretend his user name is 'bob'

• Give permission to sudo specific commands like this:

  • sudo visudo (or just visudo if you're already root)
  • add a line which looks like 'bob ALL= apt, apt-get'

What this means is user bob, from any terminal (ALL) can sudo the commands apt, and apt-get.

You'll also see bob ALL = (ALL) foo, bar on the net a lot, which means let bob run from ALL terminals as ALL users. I don't think there's any use to using apt as any other user anyway.

If you need to give your friend access to more programs, you can add more items with commas.

Answer 2

Give everybody their own LXD container, then lock them out of the host server.

Containers can look and feel like a complete system (except if you dig around the kernel), including SSH and apt. Each of your friends can have their own container, installing/removing/customizing whatever they like. It takes a fraction of the resources of a real VM.