I have a user account that is not designed for logging in interactively, but want to allow it to run a single command (as root). Is there a better way to accomplish this (without granting more rights than I intend to) than I have currently:
- Changing their shell to rbash, with sudo as the only executable in their path, as they need a valid shell in order to run any commands.
- Adding their account to sudoers with "ALL=(root:root) NOPASSWD: /sbin/executable"
- Adding an authorized_keys entry for the account with no-{X11,port}-forwarding,no-pty,command="sudo executable"
Context: I am trying to grant a non-*nix savvy manager the ability to fix any print server troubles while I am away. Obviously first port of call is the CUPS web interface and physically walking over and inspecting the printer (which he can and does do now), but I can't expect him to ssh in and restart the appropriate services when that fails (and do not trust him with unrestricted sudo access anyway). Currently I am just giving him access to run /sbin/reboot, and I will change that to a script that restarts cups/samba/etc. instead when I get a chance.