Reply To: How to create isolated, underprevileged but standard user accounts?

[anilkagiMember]

olsztyn wrote:

It is sufficient that you remove sudo entitlement as shown in the picture above by Xecure.

Thanks Olsztyn, that brought confidence in me, to move ahead.

Now I think I realized, how to create an underprivileged user.

For other newbies like me, I think you should refer to the following links to get to know about it. Unless you read on this subject a bit at least you cannot come to terms with it.

To put it in simple words;

Groups are privilege domains. Each group gives certain privileges to the user who is member of that group. For example, if the system administrator has made you the member of the 'cdrom' group, you get access to 'a CDROM drive and other optical drives', you can play CDs/DVDs, otherwise you won't be able to. The system admin can add or remove you from these groups. This is how a Linux system is secured from users affecting it in the wrong way. An user can be a malicious program too, trying to break into the system. If the malicious program has entered the system through the underprivileged user account, it cannot do anything to the system, because that user's account does not have sufficient privileges to do anything.

System Groups – Debian wiki
Privileges – Ubuntu wiki
Beginners Guide to User and Group Administration in Linux – The geek diary
Linux Users and Groups – Linode

What I did on my Antix is, I created an user with username ‘test’ with Control center from the Menu. In the groups tab I unchecked the ‘sudo’ as suggested by Olsztyn and other groups, I thought are unnecessary (I am just experimenting. I will see the results.) to make that user underprivileged. And finally I gave the following command to check which were the groups assigned to the user ‘test’;

$ groups test
test : test lp dialout cdrom floppy audio dip video users netdev scanner vnstat

I added the user to the ‘vnstat’ group, to give access to vnstat, to check internet usage.

Now my doubts here are;

Does adding the user to vnstat, give any special hidden privileges, unknown to me?

If the user ‘test’ is assigned to only these groups, does it deprive ALL the abilities to break the system, even when the user invites a malware due to reckless usage? Or how far does it deprive? What other measures regarding group assignment, can be taken, to improve the situation? Or, is this sufficient as far as User-Groups are concerned?