Users, Groups and sudo

Every person and every service should have its own account. Shared logins make it impossible to know who did what, or to remove one person's access.

Users

sudo adduser ada                    # interactive: password, details, home folder
sudo usermod -aG sudo ada           # give admin rights (Debian/Ubuntu group: sudo)
id ada                              # uid, gid and groups
sudo passwd -l ada                  # lock the password (keys still work)
sudo usermod -L -e 1 ada            # lock and expire: fully disabled
sudo deluser --remove-home ada      # delete

-aG means append to groups. Forgetting -a replaces all of the user's groups, a common way to accidentally lock someone out of sudo.

Service accounts

Applications should run as their own unprivileged user without a login shell:

sudo adduser --system --group --home /srv/pandadev --shell /usr/sbin/nologin pandadev

If the app is compromised, the attacker gets only what that user can touch.

Groups for shared access

sudo groupadd deployers
sudo usermod -aG deployers ada
sudo chgrp -R deployers /srv/releases
sudo chmod -R g+rwX /srv/releases
sudo chmod g+s /srv/releases        # new files inherit the group

sudo done right

Edit sudo rules only with visudo, which checks syntax before saving (a broken sudoers file can lock everyone out):

sudo visudo -f /etc/sudoers.d/deploy

Allow one specific command instead of everything:

ada ALL=(root) NOPASSWD: /usr/bin/systemctl restart pandadev

Now Ada's deploy script can restart the app, and nothing else, without a password.

Who did what

sudo journalctl _COMM=sudo --since today   # every sudo command today
last                                       # login history
sudo lastb                                 # failed logins
w                                          # who is logged in now

Offboarding checklist

When someone leaves: lock the account, remove their SSH key from ~/.ssh/authorized_keys, remove them from groups, rotate any shared secret they knew, and record it in the runbook.

Check yourself

• What goes wrong with usermod -G sudo ada (without -a)?
• Why should an app have its own system user?
• Why use visudo instead of a normal editor?