I have an SSH standard user account on my personal server, and it has sudo access (via its password).
I ssh in using a public key, so I don't have to type in the account password to log in. Is it safe for me to allow this user passwordless sudo access to run only the
apt-get update and
apt-get upgrade (or
apt-get dist-upgrade) commands? I'm asking from a security standpoint, not from a 'broken/buggy update' standpoint. I am the only one logging in, and if I break something with an update, I can always sudo (with a password) to fix things.
The main point is to be able to run timely updates on my server without needlessly typing in a password. But, if someone did get access to this account, I don't want them to be able to install anything, and I don't know if there are other concerns I should have with these two commands.
Here is the exact line in my
stephen ALL=(root) NOPASSWD: /usr/bin/apt-get update, /usr/bin/apt-get upgrade, /usr/bin/apt-get dist-upgrade