Ygtjki

How do one go about in creating an account with the following requirement:

• no home directory


• disabled password


• allow other users to su into this account to execute sudo commands.


• cannot ssh using this account

And also what are the security implications (if any) if such account is possible to be created?

Let assume that the OS is either CentOS or Ubuntu or Xubuntu.

A user account must have a home directory, but the user does not necessarily need to have write permission to it. If the configured home directory is not accessible at all, the user gets the HOME environment variable set to / at the beginning of the user's session.

Disabled password is easy: just use passwd -l <username>. But then, you cannot use su <username> nor su - <username> to switch to the user with the disabled password unless you are root.
(For non-root users, switching with su requires entering the target user's password - and if the password has been disabled, that won't work.)

I think you're thinking about the sudo su - <username> syntax, which was the old workaround for obsolete versions of sudo with no -i option. It requires using two tools where one is sufficient: sudo su - <username> first uses sudo to make the user become root for the purpose of running su - <username> without a password prompt.

You can achieve the same thing with sudo -iu <username>, but it requires/allows configuring /etc/sudoers to grant the other users the specific permission to use sudo to switch to this username exclusively. In other words, to allow user someuser to switch to username using just sudo

someuser ALL=(root) /bin/su - username

you would configure

someuser ALL=(username) ALL

This will allow someuser to use sudo -iu username which is 100% equivalent to sudo su - username, but without involving the old su tool at all.

Likewise, if this user needs to run specific commands with root power, you would list the allowed commands explicitly in /etc/sudoers. For example, if this user needs to be able to start and stop a particular server, you would specify:

username ALL=(root) /usr/sbin/service servicename start, 
 /usr/sbin/service servicename stop

The restriction of "cannot ssh using this account" will be quite tricky to implement. Making the user unable to execute /usr/bin/ssh will not be sufficient: if the user can create files on the system, it means the user can bring their own ssh client onto the system and use that instead. You might consider setting an outgoing iptables rule with an owner match extension, to drop any packets going to port 22 from this user:

iptables -A OUTPUT -m owner -p tcp --dport 22 --uid-owner username -j DROP

But if this user has permission to run any commands as root through sudo, then the user will be able to become root and either side-step or undo all of these restrictions. So you'll need to carefully consider which commands this user needs to be able to run with root power.