Sudo user without ability to login

Question

I have a main user with home folder encryption enabled. To avoid typing long phrase each time I want to have another user with sudo privilege and weak password.

In the terminal I would first switch user to further do any admin work

main@machine$:su test
password:{entering weak password fast}
test@machine$: sudo some action 
[sudo] password for test: {entering weak password fast}

I want user test to be unable to login under any condition and that is:

• After OS start or reboot user test should not be displayed, and GUI exit to terminal (Ctrl+Alt+F3) should also not allow to login with test
• After main user with encrypted folder login, and lock session, user test should not be able to login by any means
• Any other condition unknown to me, the main home is decrypted and I don't want any other users to access the system and thus access the files

Bonus: Ideally if another user did login, the main should auto log out to protect it's home

Please note an answer like: "disable password for sudo for main user" is not a viable solution. Reason: if left machine unattended without locking the session, I don't want someone ability to sudo without password, a weak password from other user will give me time to come back :)

Answer 1

So far I've learned it's impossible or otherwise too complex setup.

Basically in other to confirm anything as other user, that user must be able to login. When a user is set to not have login it simply can't be used (sudo or not doesn't matter).

The solution I came up with, but haven't tested 100% yet is to use hardware USD key with fingerprint reader.

• The first time login of main user would have to provide a password to decrypt home, so key is not useful and that's desired behavior.
• There would not be other users to keep system 100% sealed
• required elevated sudo operation would be confirmed by a fingerprint

This approach satisfies "if left machine unattended without locking the session, I don't want someone ability to sudo without password"

The cons to the solution

• must carry the key all the time, when traveling, but at least still can perform sudo operations without a key just need to type long password
• USB port constantly occupied, my not be best for laptops with limited ports without docking station