I've been running a server with a few friends for a while, we all share the server, though I am the person who actually pays for the server.
I'm running all of my stuff as the root user.
(I know, it's a bad idea, and can cause unrecoverable damage, but it was the easiest thing for me to do when setting up the server, and if I want to go into someone elses files, I don't have to worry about permissions, and they can't get into my files by most methods)
I don't want ANY of the regular users to be able to get into the root user, or the /root directory without actually logging into root with the root account's password. I've got
su - root disabled, but there's still
sudo -s, and the ability to just
sudo cp -R /root ~/rootStuff, I don't want them to be able to get into the actual root account, or the directory, all the really need to be able to do is work in their own home directories, and the stuff that's regularly accessible by everyone,
don't want to fully take sudo away from all of them, since this means that anything they have to do around the server, like properly installing packages, will involve me, but if it's the best way, I can do that.
It's not like I don't trust the people I have on my server, I do, they're good friends, I just have some pretty sensitive stuff stored in /root.
The only commands they really need to be able to sudo are
apt, and maybe some other random commands down the road, but I can deal with that when I get there.
The server's version is 18.04.3 LTS if that makes much of a difference. Also, the server is a dedicated server from a hosting company, I only have ssh, no physical access, or visual.