What are the privlages i should give to a standard user account?

Question

What privliges should i give to a standard account? what should i remove? The user i am changing was the original Main admin account. I have set up a second account that will be my new main admin that will be added to all groups.

Edit:I already know how to change the user to standard, i was wondering what groups the standard user should be allowed into?

Answer 1

after add user for setup privilage do bellow guid first setup your favorit edittor for open sudoconfiguration file

sudo update-alternatives --config editor

after setup favorite edditor open sudo configuration with sudo visudo find line with like this content # User privilege specification and add similar demo ALL=(ALL:ALL) ALL The first field indicates the username that the rule will apply to (demo).

demo ALL=(ALL:ALL) ALL

The first "ALL" indicates that this rule applies to all hosts.

demo ALL=(ALL:ALL) ALL

This "ALL" indicates that the demo user can run commands as all users.

demo ALL=(ALL:ALL) ALL

This "ALL" indicates that the demo user can run commands as all groups.

demo ALL=(ALL:ALL) ALL

The last "ALL" indicates these rules apply to all commands.

demo ALL=(ALL:ALL) ALL

Names beginning with a "%" indicate group names.

There are a number of ways that you can achieve more control over how sudo reacts to a call.

The updatedb command associated with the "mlocate" package is relatively harmless. If we want to allow users to execute it with root privileges without having to type a password, we can make a rule like this:

GROUPONE    ALL = NOPASSWD: /usr/bin/updatedb

NOPASSWD is a "tag" that means no password will be requested. It has a companion command called PASSWD, which is the default behavior. A tag is relevant for the rest of the rule unless overruled by its "twin" tag later down the line.

For instance, we can have a line like this:

GROUPTWO    ALL = NOPASSWD: /usr/bin/updatedb, PASSWD: /bin/kill

Another helpful tag is "NOEXEC", which can be used to prevent some dangerous behavior in certain programs.

For example, some programs, like "less", can spawn other commands by typing this from within their interface:

!command_to_run This basically executes any command the user gives it with the same permissions that "less" is running under, which can be quite dangerous.

To restrict this, we could use a line like this:

username    ALL = NOEXEC: /usr/bin/less

If you are simply wondering what kind of privileges are defined for your username, you can type:

sudo -l

source of article