SSH via a password is less secure than SSH with a DSA/RSA certificate. Create a certificate with a password. Then give the sys admin account a different password.
You will only be able to login via SSH if you have the certificate AND know the password associated with it.
You can then use a different password for running sudo (the user's password).
This gives you a lot more security!
Remember to use pass phrases and not passwords too. The difference being a pass phrase is made up of many words (greater than 20 characters say). The longer the password, the more time it would take to break via dictionary attacks.
To create a certificate:
- type ssh-keygen at a terminal and follow the instructions (giving a unique filename and enter your pass phrase)
- then copy the public key onto the server you are administering using ssh-copy-id -i path/to/your/sshkey.pub
- Now log on to your server and turn off password authentication in /etc/ssh/sshd_config and restart the sshd service
You're basically asking: "How to copy settings and files from my user account to a new user account, skipping some settings?"
Migrating to a new user account
To move files from user old
to new
, you need to copy over the files and change the ownership accordingly:
sudo cp -r -d --preserve=mode,timestamps -T ~old ~new
sudo chown -R new: ~new
This should copy the files without modifying paths.
Now log in to a shell as new
. Either switch to a VTY using Ctrl + Alt + F1 and login as new
or login from a terminal using su new
. If you chose the first method, you can switch back with Ctrl + Alt + F7. From this point, it's assumed that you're logged in as new
.
If symbolic links exist which point to their old directories, find those links:
find ~ -lname '*/old/*' -ls
The file names of the symbolic links are printed, but no action has been taken. To create a new symlink ~new/path/to/symlink
pointing to ~old/point/to/target
, overwriting the old one, run:
ln -sf ~old/point/to/target ~new/path/to/symlink
There could be configuration files referring to the old ones, you can find those files with grep
:
grep -HrnI 'old' ~
If you get many results, consider being more specific, i.e. replace old
by /home/old
. Files will be listed with lines matching the search criteria, but no action is taken.
Debugging the old account
If you copy all settings and files, you're better off with removing the problematic files. For optimal results, it's a good idea to logout the subject user from a GUI session and log in a virtual console (switch to it using Ctrl + Alt + F1).
If you're suddenly being logged out, check ~/.xsession-errors
. You can do so by running:
less ~/.xsession-errors
Use arrow keys, Page Up/Down, Home or End to navigate, press Q to quit.
Sometimes the .gconfd/saved_state
file gets corrupt. You can remove this file with:
rm .gconfd/saved_state
After doing this, switch back to a GUI login by pressing Ctrl + Alt + F7. Log in and if the problem went away, you're done. Otherwise, log out and switch back to the virtual console using Ctrl + Alt + F1.
Another directory that can be emptied is ~/.cache
:
rm -r ~/.cache/*
Instead of loosing all files and settings, temporary move some folders. That can be done with:
mv folder{,-orig}
If a folder was not causing issues, remove the newly created folder and restore the old one:
rm -r folder
mv folder{-orig,}
Some folders that could cause problems (some may be nonexistent, in that case skip to the next folder):
.gnome
.gnome2
.kde
.config
.local
As with every modification, switch back to a GUI login and test it.
Best Answer
User accounts are not allowed to use the
sudo
command, meaning there is no way for them to access any root privileges, meaning no package installations or filesystem tampering, etc.To block a user from using a program, a simple way is to create a whitelist for that program. To do this, use the following commands in the terminal:
Where GROUP is the name you want for the whitelist for the program, PROGRAM is the name of the program, and "alice" and "bob" are replaced with the actual users on your system you want to allow access. Any users not in the group will be denied access.