{"id":4279,"date":"2022-05-31T06:14:18","date_gmt":"2022-05-31T06:14:18","guid":{"rendered":"https:\/\/droidweekly.com\/how-do-i-remove-a-sudo-user-answer-2022\/"},"modified":"2022-05-31T06:14:18","modified_gmt":"2022-05-31T06:14:18","slug":"how-do-i-remove-a-sudo-user-answer-2022","status":"publish","type":"post","link":"https:\/\/droidweekly.com\/how-do-i-remove-a-sudo-user-answer-2022\/","title":{"rendered":"How do I remove a sudo user? &#8211; [Answer] 2022"},"content":{"rendered":"<div class=\"entry-content clear\" itemprop=\"text\">\n<p>Answer<\/p>\n<p>To make<strong> things <\/strong>easier for <strong>multiple <\/strong>users, you should <strong>create <\/strong>a separate user <strong>account <\/strong>for each one. Even if you no <strong>longer <\/strong>need that particular <strong>person <\/strong>to use your server, <strong>deleting<\/strong> their user is a simple <strong>process <\/strong>by running the command <strong>deluser <\/strong>\u2212remove-home <strong>username<\/strong>.<\/p>\n<h2>How to grant terminal root without typing sudo su every time in Kali linux<\/h2>\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\">\n<div class=\"wp-block-embed__wrapper\">\n<div class=\"ast-oembed-container\" style=\"height: 100%;\"><iframe loading=\"lazy\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen=\"\" frameborder=\"0\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/GV23_8WFoSo?feature=oembed\" title=\"How to grant terminal root without typing sudo su every time in Kali linux 2020 \u2714\ufe0f\" width=\"1200\"><\/iframe><\/div>\n<\/div>\n<\/figure>\n<p>Hmmm. I\u2019d need to add \/bin\/bash for him to have bash . But he already had \/bin\/sh , so how about replacing this with a symlink? Time to do some reading:<\/p>\n<p>Next I decided that if I was going to go through all that trouble of adding shell access, perhaps there might be some merit in bring him up to date on AppArmor by changing his default profile. This would provide much better protection than what\u2019s currently available via SELinux, and may even help cure some of my headaches! Very happy with this decision and eagerly set about updating his profile:<\/p>\n<p>So I\u2019d created his needed directories, sudoers configuration and updated his AppArmor profile. All that was left to do was create a shell with bash in it for the user &amp; SELinux would be happy\u2026 right? Well apparently not. Even after fixing all of these things, sestatus reported the same thing! So next step is to check what commands he had available to see if perhaps this was just a listing issue on my server:<\/p>\n<p>As you can see above, despite everything being ticked to allow him access via apparmor (the file is even owned by root!) It doesn\u2019t work! Instead what happens is that when moving into the directory which contains the AllowedApps_full path, he\u2019s still denied access! Time to sort this out then\u2026<\/p>\n<p>Ah, there we go. So the command is installed\u2026 but it hasn\u2019t been given execute permissions and SELinux isn\u2019t happy about that because it doesn\u2019t have a valid policy for the application at boot time. I can attempt to give him full access on an on-going basis using the sesearch command:<\/p>\n<h2>How to add user to sudoers in Linux<\/h2>\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\">\n<div class=\"wp-block-embed__wrapper\">\n<div class=\"ast-oembed-container\" style=\"height: 100%;\"><iframe allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen=\"\" frameborder=\"0\" height=\"675\" loading=\"lazy\" src=\"https:\/\/www.youtube.com\/embed\/WBgkuGQkwzk?feature=oembed\" title=\"How to add user to sudoers in Linux\" width=\"1200\"><\/iframe><\/div>\n<\/div>\n<\/figure>\n<p>Unfortunately if this permission were to be removed again in the future or if a program without it\u2019s own AO (like lets say wget ) was used instead of fetch , then this would stop working. I could try and fix this with some post-transaction script magic:<\/p>\n<p>Not sure why, but it seems as though fetch has been installed incorrectly so it can\u2019t find any user-applied policies at boot time. The first thing would be to check the hash:<\/p>\n<p>So we know that the application exists on disk and hasn\u2019t been deleted or moved \u2013 just missing access via SELinux. So I decide to try and see if I can fix this using the audit2allow command:<\/p>\n<p>So the application matched a rule, but it\u2019s not going to be applied due to our current policy (which is very restrictive). Time for plan B\u2026<\/p>\n<p>I\u2019ve updated my policy file with all of the correct entries so that fetch now has access via SELinux. It should show up in sestatus when we run it, but does it? Let\u2019s find out:<\/p>\n<p>Great! So we have successfully managed to give him permission through apparmor and SELinux and even turn on some logging for wget \/ fetch ! But there doesn\u2019t seem to be anything happening within his session\u2026 why not? Well let\u2019s see what happens when we try something<\/p>\n<div class=\"schema-faq wp-block-yoast-faq-block\">\n<div class=\"schema-faq-section\" id=\"faq-question-1625238754375\"><strong class=\"schema-faq-question\">How do I remove a sudo user?<\/strong> <\/p>\n<p class=\"schema-faq-answer\">To make<strong> things <\/strong>easier for <strong>multiple <\/strong>users, you should <strong>create <\/strong>a separate user <strong>account <\/strong>for each one. Even if you no <strong>longer <\/strong>need that particular <strong>person <\/strong>to use your server, <strong>deleting<\/strong> their user is a simple <strong>process <\/strong>by running the command <strong>deluser <\/strong>\u2212remove-home <strong>username<\/strong>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- AI CONTENT END 1 -->\n<\/div \n\n","protected":false},"excerpt":{"rendered":"<p>Answer To make things easier for multiple users, you should create a separate user account for each one. Even if you no longer need that particular person to use your server, deleting their user is a simple process by running the command deluser \u2212remove-home username. How to grant terminal root without typing sudo su every &#8230; <a title=\"How do I remove a sudo user? &#8211; [Answer] 2022\" class=\"read-more\" href=\"https:\/\/droidweekly.com\/how-do-i-remove-a-sudo-user-answer-2022\/\" aria-label=\"More on How do I remove a sudo user? &#8211; [Answer] 2022\">Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/droidweekly.com\/wp-json\/wp\/v2\/posts\/4279"}],"collection":[{"href":"https:\/\/droidweekly.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/droidweekly.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/droidweekly.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/droidweekly.com\/wp-json\/wp\/v2\/comments?post=4279"}],"version-history":[{"count":0,"href":"https:\/\/droidweekly.com\/wp-json\/wp\/v2\/posts\/4279\/revisions"}],"wp:attachment":[{"href":"https:\/\/droidweekly.com\/wp-json\/wp\/v2\/media?parent=4279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/droidweekly.com\/wp-json\/wp\/v2\/categories?post=4279"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/droidweekly.com\/wp-json\/wp\/v2\/tags?post=4279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}