1

I want to remove my default user from the sudo group. IOW I want to change it to an unprivileged account. However it also seems to be a member of ten other system groups.

  1. What is the overall security implication of this. Are any of these groups also root-equivalent (like if you grant a user access to Docker)?

  2. How important are these groups? If I remove my user from them, am I setting myself up for ten different troubleshooting sessions later on? (Probably having to just re-enable them, i.e. this would just be imposing suffering on myself).

List of groups for the user created by the installer, taken from a near-untouched Debian 8 install (test VM):

cdrom floppy sudo audio dip video plugdev netdev lpadmin scanner bluetooth

Context: I'm trying to implement privilege separation. I'd like to have a sysop user which can do root-only tasks, and has ssh access to a similar server account. The idea is to provide better containment for online entertainment, without giving up remote administration entirely.

E.g. ransomeware seeking to corrupt the backups on my server would require privilege escalation. It would not be able to reconfigure my normal user to capture sudo passwords, or ssh access to the sysop account on the server.

Improve this question

1 Answer 1

Reset to default
1

Creating new users with adduser, which claims to be a friendly frontend, provides none of these groups.

I checked a multi-user system, running Debian's GNOME desktop. Users beyond the first were not a member of these groups. The system has been running for a while without noticing a problem from this. (lpadmin is the only one I have any concern about there. Printing is suffering).

Fedora Linux (23) does not add users to groups like this, neither in the installer nor when created using the GNOME Users tool.

Many of the groups, at least, are obsolete for desktop use. When you log in locally, the session manager systemd-logind will grant access to certain types of device nodes, using ACLs. The netdev and plugdev groups could be considered obsoleted by NetworkManager and udisks (which use polkit to determine policy).

(The Debian Wiki currently says that NetworkManager is configured to allow users in the netdev group. It is out of date. I have checked on Debian 9: no allowance is made for netdev, and the group is not mentioned in any PolKit policy).

So I don't think removing these groups will cause ten-fold agony. It's possible Debian (being older) will currently lack some features Fedora is relying on here, but personally I can manage that.

I believe there was a concern in the past, that the floppy group allowed raw access to USB storage devices, which might hold system filesystems. This was resolved in Debian 8. You could take this as a point either way. For people who are less confident about troubleshooting, at least it shows that Debian was still monitoring and managing the security implications of these groups.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .