I'm doing this over ssh.
I want to create a user that:
can't be accessed via ssh
can be impersonated with
su
doesn't have a password (is this a good practice?)
can run web apps (specifically with pm2 (nodejs))
This is how we do it at work -- I access a server via ssh (pem key) and then su to the nodejs
user and run the app. I've read a few answers here but they are usually in the form of "I created a user but it doesn't work, what's wrong"
I created a user with adduser nodejs --system --group
but it has a password that I don't know. Perhaps I just need to add something to that command.
OS is Mint/Ubuntu.
username:x:
on the other hand, assuming a system that uses hashed passwords (like virtually all these days), will prompt for a password but none will be valid. – Ed Grimm Feb 3 '19 at 2:54sudo -u username
is probably a much better way to get access to such a restricted account than su, as it uses the credentials from the originating account rather than the target account. One would, of course, need sudo configured to allow that. – Ed Grimm Feb 3 '19 at 2:56sudo su
sets off my bad code sense. I especially twitch when someone doesn't even bother to give a username to su, but is instead doing that to get their root prompt. I understand it doesn't matter really. But why would I suggest someone run two commands rather than one, especially when the second command would work around the added sophistication of the first? For me,su
is just an emergency way to get root access to fix my coworker's mistake with the /etc/sudoers file and otherwise bad memories I want to forget. – Ed Grimm Feb 3 '19 at 20:32