User A - can't be part of sudo or admin group, ssh keys based identity setup for ssh login, can't be a guest account

User B - no home folder, must have a password, can't have independent ssh login, should be part of sudo / admin group

User A don't need any sudo access for most of it's operation. But for some emergency cases, when root access is required we have to switch to User B while logged in as User A.

While switching from User A to User B, we should use User B's password. I.e. only some people logging as User A should be able to switch to become User B.

Please help in setting up such users. Thanks in advance.

  • Easiest solution is to give those users who need access a key to access user B , then then can log in as either user A (most of the time) or user B in emergencies. Manually configuring otherwise will take a lot of time and have the same effect. – Panther May 7 '15 at 19:03
  • User B can't have keys as it has to be kind of hidden (with no home folder) from most of the users, hence the password. And sshd will be configured to not allow password logins. So, the only way for anyone to get into the server is by becoming User A. I know it's weird, but that's how the requirement is. – kaychaks May 7 '15 at 19:11
  • I have no experience in this, but what you want seems simple. Start with user B with sudo admin right. This can be the user you create during Ubuntu install. Create a temp admin user and login as temp to delete B's home (I don't know if you will get into trouble for doing this). Create standard user A with home folder /home/A but no sudo. setup ssh to use pvt pub keys for user B and disable password login in ssh. That's it. ssh as A. use su - B to switch to B if you need to use sudo. – user68186 May 7 '15 at 19:59
  • If the above works I will be happy to write a full answer. – user68186 May 7 '15 at 20:01
  • 1
    Store the ssh keys outside home, this is configured in /etc/ssh/sshd_config and as I use encrypted home directories, I use /etc/ssh/ , you could use /usr/local/ssh or any location you wish. – Panther May 7 '15 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.