14 Sep
2021
14 Sep
'21
8:01 a.m.
Hi all,
Hopefully an easy one I can get help with.
I would like to add a new user to the server.
I found the following guide works for me:
https://thucnc.medium.com/how-to-create-a-sudo-user-on-ubuntu-and-allow-ssh…
Is there a gotcha that will cause a problem down the line?
The server is used as a playground for the weareveryone.org no serious
coding.
Regards,
Andres
--
Andres Muniz-Piniella (he/him/his) CEng mIoP
Everyone’s Warehouse Manager
Participatory City
47 Thames Road
IG11 0HQ
+44 7704 003974
Sent while on the Move
Please tell me how was your day at the Warehouse!
https://eoed.typeform.com/to/i2q8Gf
14 Sep
14 Sep
8:45 a.m.
Hi Andres
On 14/09/2021 10:01, Andres Muniz wrote:
Hi all,
Hopefully an easy one I can get help with.
I would like to add a new user to the server.
There are two commands adduser and
useradd. According to the manpage
(man useradd) it is more convenient to use adduser.
I found the following guide works for me:
https://thucnc.medium.com/how-to-create-a-sudo-user-on-ubuntu-and-allow-ssh…
<https://thucnc.medium.com/how-to-create-a-sudo-user-on-ubuntu-and-allow-ssh-login-20e28065d9ff>
Is there a gotcha that will cause a problem down the line?
As it comes to keys see below how I usually do it - on debian though
***** Create Key
me@client:~$ ssh-keygen -t rsa -b 4096 -C "mykey"
me@client:~$ ls -l ~/.ssh | grep mykey*
-r-------- 1 me me 3326 Dec 31 12:46 mykey
-r-------- 1 me me 744 Dec 31 12:46 mykey.pub
***** Deploy Key
me@client:~$ ssh USER@HOST "echo \"$(cat ~/.ssh/public-key.pub)\" >>
.ssh/authorized_keys"
me@host:~$ ls -la | grep ssh
drwxr-xr-x 2 me me 4096 Dec 31 11:53 .ssh
me@host:~$ ls -l .ssh/authorized_keys
-rw------- 1 me me 744 Dec 31 11:55 .ssh/authorized_keys
***** Edit /etc/ssh/sshd_config on Host
Change
PasswordAuthentication yes
into
PasswordAuthentication no
Then do 'systemctl restart ssh.service'
Regards,
Sam
12:32 p.m.
On 14/09/2021 09:45, Samuel Bächler wrote:
<snip>
***** Edit /etc/ssh/sshd_config on Host
Change
PasswordAuthentication yes
into
PasswordAuthentication no
Then do 'systemctl restart ssh.service'
I would also recommend, to better secure your server against logon
attempts, adding 'AllowUsers' and a list of allowed users to sshd_config
or, if you have a lot of users requiring access or will be changing the
list reasonably often, 'AllowGroups' and add users requiring access to
the specified group(s). Remember to reload or restart the ssh service
whenever you change sshd_config.
Gavin
2:26 p.m.
On Tue, Sep 14, 2021 at 10:45:47AM +0200, Samuel Bächler wrote:
***** Deploy Key
me@client:~$ ssh USER@HOST "echo \"$(cat ~/.ssh/public-key.pub)\"
>>
.ssh/authorized_keys"
There's "ssh-copy-id" to do this bit a little easier:
$ ssh-copy-id user@host
takes care of putting all loaded identities into that user@host's
authorized_keys file. If the key isn't already loaded as an identity
(or you only mean to add a specific one) you can force it to use it
like:
$ ssh-copy-id -i ~/.ssh/mykey user@host
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
4:23 p.m.
Hello Samuel!
On 2021-09-14 10:45+0200, Samuel Bächler wrote:
There are two commands adduser and useradd. According
to the manpage
(man useradd) it is more convenient to use adduser.
That's a Debian patch to the man page:
<https://salsa.debian.org/debian/shadow/-/blob/master/debian/patches/505_useradd_recommend_adduser>
I think there's another distro somewhere that recommends the inverse.
Personally I'm a 'useradd' fan, I didn't like the interactive nature of
adduser at some point. Normally, useradd -m 'whoeever' gets what I want,
when on a service desk I ask the end user if they have a crypt string,
then useradd -p 'crypt' -m 'whoever' gets what I want... Just my
personal preference.
Upstream makes no recommendation between the two :)
Ed
9:08 a.m.
The only gotcha I can think of is that you're adding one more route by
which an intruder can access your system. Make sure you have remote
password login disable, and if you can control the behaviour of your new
user, make sure he or she uses only a passphrase protected ssh key when
accessing your server.
Cheers,
John
On 14/09/2021 09:01, Andres Muniz wrote:
Hi all,
Hopefully an easy one I can get help with.
I would like to add a new user to the server.
I found the following guide works for me:
https://thucnc.medium.com/how-to-create-a-sudo-user-on-ubuntu-and-allow-ssh…
<https://thucnc.medium.com/how-to-create-a-sudo-user-on-ubuntu-and-allow-ssh-login-20e28065d9ff>
Is there a gotcha that will cause a problem down the line?
The server is used as a playground for the weareveryone.org
<http://weareveryone.org> no serious coding.
Regards,
Andres
--
Andres Muniz-Piniella (he/him/his) CEng mIoP
Everyone’s Warehouse Manager
Participatory City
47 Thames Road
IG11 0HQ
+44 7704 003974
Sent while on the Move
Please tell me how was your day at the Warehouse!
https://eoed.typeform.com/to/i2q8Gf <https://eoed.typeform.com/to/i2q8Gf>
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
--
Xronos Scheduler - https://xronos.uk/
All your school's schedule information in one place.
Timetable, activities, homework, public events - the lot
Live demo at https://schedulerdemo.xronos.uk/
2:47 p.m.
Hello,
On Tue, Sep 14, 2021 at 09:01:35AM +0100, Andres Muniz wrote:
I would like to add a new user to the server.
I found the following guide works for me:
https://thucnc.medium.com/how-to-create-a-sudo-user-on-ubuntu-and-allow-ssh…
Seems okay only a couple of comments:
- I don't know why it's saying "ssh root@server_address" as the
first step when root login is normally disabled on ubuntu, and
then it doesn't use root login anywhere else in the instructions
anyway - it just uses sudo.
- Creating ~/.ssh and editing ~/.ssh/authorized_keys: It might be
worth mentioning that the permissions on these files/directory
need to be quite tight. Depending on what your user's umask is,
creating them may leave them as "other" readable and then sshd
will ignore them.
I tend to recursively remove all group and other permissions after
creating authorized_keys:
$ chmod -Rc go= ~/.ssh
Or if doing this for another user:
$ sudo chmod -Rc go= ~user/.ssh
R - recursive
c - show changes
go= - set group and other permissions to nothing
I would echo the other comments about securing SSH. If possible it
would be really good to turn off password access and only allow
access by SSH public keys. The most common form of compromise here
is still brute force SSH dictionary attack. It only takes someone to
set their password to something weak, or for example if someone were
to add a user "mysite" with password "mysite" never intended to log
in only to hold files for a web site. That has happened before
(there are better ways to do that though).
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
949
days inactive
949
days old
6 comments
6 participants
participants (6)
-
Andres Muniz -
Andy Smith -
Ed Neville -
Gavin Westwood -
John Winters -
Samuel Bächler