1

I have a main user with home folder encryption enabled. To avoid typing long phrase each time I want to have another user with sudo privilege and weak password.

In the terminal I would first switch user to further do any admin work

main@machine$:su test
password:{entering weak password fast}
test@machine$: sudo some action 
[sudo] password for test: {entering weak password fast}

I want user test to be unable to login under any condition and that is:

  • After OS start or reboot user test should not be displayed, and GUI exit to terminal (Ctrl+Alt+F3) should also not allow to login with test
  • After main user with encrypted folder login, and lock session, user test should not be able to login by any means
  • Any other condition unknown to me, the main home is decrypted and I don't want any other users to access the system and thus access the files

Bonus: Ideally if another user did login, the main should auto log out to protect it's home

Please note an answer like: "disable password for sudo for main user" is not a viable solution. Reason: if left machine unattended without locking the session, I don't want someone ability to sudo without password, a weak password from other user will give me time to come back :)

2
  • Multi user systems were not designed to operate within the constraints you have defined, your options are basically 1) implement you own auth system 2) redesign your criteria, ie: make the encrypted folder something you mount when needed instead of your home folder
    – wireghoul
    Commented Mar 30, 2023 at 23:48
  • I guess what I want to achieve is maybe a short sudo password vs long login password that protects home dir unix.stackexchange.com/q/94626/194331 or unix.stackexchange.com/a/94700/194331 Commented Apr 5, 2023 at 2:47

1 Answer 1

1

So far I've learned it's impossible or otherwise too complex setup.

Basically in other to confirm anything as other user, that user must be able to login. When a user is set to not have login it simply can't be used (sudo or not doesn't matter).

The solution I came up with, but haven't tested 100% yet is to use hardware USD key with fingerprint reader.

  • The first time login of main user would have to provide a password to decrypt home, so key is not useful and that's desired behavior.
  • There would not be other users to keep system 100% sealed
  • required elevated sudo operation would be confirmed by a fingerprint

This approach satisfies "if left machine unattended without locking the session, I don't want someone ability to sudo without password"

The cons to the solution

  • must carry the key all the time, when traveling, but at least still can perform sudo operations without a key just need to type long password
  • USB port constantly occupied, my not be best for laptops with limited ports without docking station

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .