Creating a server account for a friend (users and permissions)

When you manage a server or build a bot together with a friend, it's safer to create an account just for them than to give them your account's password. Later you only need to delete that account, and you can also tell who did what. This guide is based on Ubuntu/Debian.

1. Create the account

sudo adduser friend-id

Enter the password twice; you can skip the rest of the questions, such as name, with Enter. Your friend can now connect with ssh friend-id@server-ip.

2. Give administrator privileges (sudo) — only if you truly trust them

With sudo privileges, they can change and delete anything on the server. Only give it when it's really needed.

sudo usermod -aG sudo friend-id

To take the privileges away again:

sudo deluser friend-id sudo

Fedora uses the wheel group instead of the sudo group. (sudo usermod -aG wheel friend-id)

3. Share a folder

To let them edit only a specific folder (e.g., your bot folder) together with you, without sudo privileges, create a group.

sudo groupadd botteam                          # Create the group
sudo usermod -aG botteam $USER                 # Add yourself to the group
sudo usermod -aG botteam friend-id              # Add your friend to the group
sudo chgrp -R botteam /home/myid/mybot         # Make the group own the folder
sudo chmod -R g+rwX /home/myid/mybot           # Give the group read/write permissions
sudo chmod g+s /home/myid/mybot                # New files get the same group too
sudo chmod o+x /home/myid                     # Let your friend pass through your home folder

Group changes take effect after you reconnect.

4. Have your friend log in with an SSH key (recommended)

Get your friend's public key (the contents of their id_ed25519.pub file, a single line starting with ssh-ed25519) and register it. No passwords need to be exchanged.

sudo mkdir -p /home/friend-id/.ssh
echo "the public key line your friend sent" | sudo tee -a /home/friend-id/.ssh/authorized_keys
sudo chown -R friend-id:friend-id /home/friend-id/.ssh
sudo chmod 700 /home/friend-id/.ssh
sudo chmod 600 /home/friend-id/.ssh/authorized_keys

For how to create a key, see "Connecting without a password using SSH keys" in the SSH connection guide.

5. Delete the account

When you're done sharing, delete the account. Adding --remove-home also deletes your friend's home folder, so move any files you need first.

sudo deluser --remove-home friend-id

Commands for checking

id friend-id        # Which groups they belong to
who                 # Who's logged in right now
last -n 20          # Recent logins

On a Windows server, you can create accounts in Settings → Accounts → Other users or in "Computer Management → Local Users and Groups". To connect with Remote Desktop, the account has to be added to the "Remote Desktop Users" group.