I want to create an account on my own server for a friend who wants to use weechat.

I have created an account adduser friend and created an ssh pair for his login such that password login is disabled.

I trust the friend to not try and destroy my system but I am wondering what additional security measures I should take. It can always happen that his account gets compromised.

He does not have sudo rights at the moment, which he does not need. Actually, all he needs is to execute weechat in tmux.

As it currently stands he can navigate system directories but not remove anything. He can also browse other users' home directories.

Is there any recommended additional setup I can do to make his account as safe as possible in case of being compromised?

I have read about unprivileged accounts but that seems to be too restricting because he requires a home directory for weechat. To disallow him to read into my home directory I had read about modifying the permissions on all the other home directories. However, I think there should be a way to modify his account instead of all the other home directories?


Consider setting up a unique group for this user, so that he can only see files and directories that have read permission for "other" or that group. Then the main concern is what things in the filesystem have permissions for "other", which is a good thing to review anyway.

In addition, some people have had success changing the login shell to the desired program you want to give access to (weechat). Then it would run immediately upon login, and he would be logged out when he exits. Some programs are able to launch a shell, so this by itself isn't complete protection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.