How can I do system maintenance using a limited standard account?

My network has suddenly decided to sign me in to everybody else’s network but my own. It refuses to let me disconnect from those and it refusing to let me sign on to my own network.

Summary

I forgot to mention I do not have any of those passwords for the passworded networks. One of them is my printer but it requires a password and I didn’t password protect my printer.

how fast is the connection? speedtest

I guess some people could use that feature

anymore info’s like?
System:

LANG=C inxi -Fnzy 

or when it happening:

sudo journalctl -r 
1 Like

… cool feature - you could cancel your monthly payment to your provider as long as you can use all the other peoples connections :wink:

seriously:
right click the NetworkManager icon in the tray and deactivate the wireless network
or the network in general
then activate it again

as a first step …

2 Likes

I have OUTSTANDING internet, I am not trading it for the horrible internet these others are dishing out. Lol, I’ll pay and keep my own.

Somehow, without my input, it fixed itself.

Also, I think I need to activate root account because when I tried doing the sudo command above it asked for this standard accounts password then said it wasn’t in the sudoers file. I cannot put this account in sudoers account because I need to allow others to use it at conventions. Why doesn’t it ask for an administrators password instead?

No need.

When some user (account) is a member of the group “wheel”, then that user can use sudo to do administrative tasks - effectively become root, after being asked for his password.
(not the root users password - that is separate, although it may be the same, which it shouldn’t be, but that’s your decision)

When some user is not a member of this group, he can’t do this.
He won’t even be asked for the administrators password.

no need - but you can do it if you want
Just set a password for root.
(you are opening up one more “attack” vector by activating the root account)

btw:

You can eliminate sudo completely - and replace it with doas.

doas - ArchWiki

It’s not as convenient as sudo - but supposedly even safer.

There is also run0, which uses polkit for authentication, and was introduced in systemd v256 last year:

Will Linux’s New run0 Command Run sudo Out of Town? - How-To Geek

I use run0 in the terminal probably more often than sudo, and have also included it in quite a few of my scripts.

However, some commands, such as mkinitcpio, still seem to prefer sudo, as using run0 results in a zstd: error 70 : Write error : cannot write block : Broken pipe error message after Running build hook: [kms]:

run0 mkinitcpio -P
run0 mkinitcpio -P 
==> Building image from preset: /etc/mkinitcpio.d/linux612.preset: 'default'
==> Using default configuration file: '/etc/mkinitcpio.conf'
  -> -k /boot/vmlinuz-6.12-x86_64 -g /boot/initramfs-6.12-x86_64.img
==> Starting build: '6.12.21-4-MANJARO'
  -> Running build hook: [base]
  -> Running build hook: [udev]
  -> Running build hook: [autodetect]
  -> Running build hook: [microcode]
  -> Running build hook: [modconf]
  -> Running build hook: [kms]
zstd: error 70 : Write error : cannot write block : Broken pipe 
  -> Running build hook: [keyboard]
  -> Running build hook: [keymap]
  -> Running build hook: [consolefont]
  -> Running build hook: [block]
  -> Running build hook: [filesystems]
  -> Running build hook: [fsck]
==> Generating module dependencies
==> Creating zstd-compressed initcpio image: '/boot/initramfs-6.12-x86_64.img'
  -> Early uncompressed CPIO image generation successful
==> Initcpio image generation successful

The error doesn’t appear when sudo is used:

sudo mkinitcpio -P
sudo mkinitcpio -P 
[sudo] password for scotty: 
==> Building image from preset: /etc/mkinitcpio.d/linux612.preset: 'default'
==> Using default configuration file: '/etc/mkinitcpio.conf'
  -> -k /boot/vmlinuz-6.12-x86_64 -g /boot/initramfs-6.12-x86_64.img
==> Starting build: '6.12.21-4-MANJARO'
  -> Running build hook: [base]
  -> Running build hook: [udev]
  -> Running build hook: [autodetect]
  -> Running build hook: [microcode]
  -> Running build hook: [modconf]
  -> Running build hook: [kms]
  -> Running build hook: [keyboard]
  -> Running build hook: [keymap]
  -> Running build hook: [consolefont]
  -> Running build hook: [block]
  -> Running build hook: [filesystems]
  -> Running build hook: [fsck]
==> Generating module dependencies
==> Creating zstd-compressed initcpio image: '/boot/initramfs-6.12-x86_64.img'
  -> Early uncompressed CPIO image generation successful
==> Initcpio image generation successful
1 Like

I have never heard of “wheel”. Does it give administrator powers to an account?
This is the message I get when using sudo:

sudo journalctl -r
[sudo] password for rich:
rich is not in the sudoers file.

Mod edit: Image removed. Please don’t upload screenshots of terminal output.

And again, I cannot allow this account to have administrative authority. Is there a way to tell the OS to ask for an administrator password?

The first user on a Manjaro system is always member of wheel group.

To see which groups your current user is member off execute in terminal

 $ groups
fh sys network power wireshark adbusers docker libvirt uucp lp wheel

The message you are getting is pointing to an ordinary user account created by your system administrator.

Did you - by any chance - run any .pacnew maintenance where /etc/shadow was part of the changes?

Have a look here - the Arch wiki, the whole page, but especially the section the link takes you to (user groups):

Users and groups - ArchWiki

sudoers is a different matter

There is no need to use sudo with that command - works just fine without.

There is a file which the installer puts by default:

/etc/sudoers.d/10-installer
content:
%wheel ALL=(ALL) ALL

This is what allows every user belonging to that group to use sudo for everything.
If a user is not in that group, they can’t use sudo.

su is a different matter, separate from sudo

The purpose of sudo is to temporarily elevate user privileges to virtually equal that of root (the super user, or administrator).

When entering sudo the User’s password is requested - this is normal for a User listed in the sudoers file. Without the User (or the required group that the user belongs to; wheel) being added to sudoers, sudo will generate the message you previously noted.

The user does not have root-like permissions at all times; which I believe is a misconception you have indicated.

Again, sudo asks to elevate privileges, and you provide the your password to achieve it. After a short time that elevation reverts to the previous permissions of the User.

I hope this helps.

Regards.

If this were your computer and you were using it in a place like a convention where others would be using your computer without supervision would you put this standard user in the sudoers group?

Of course not! -
if they know your password, they can get admin with it by using sudo
and proceed to do literally anything

and you can be pretty sure that at least one will surely try - and discover this and … be a jerk or worse

It’d actually be more of an invitation by you to them to screw with the system …

And there is the key… If you cannot safeguard your password then don’t use a network facing computer.

In your mentioned convention environment, you should always make a large banner with your User and Admin passwords proudly displayed so that everyone can see them. :scream_cat:

Think about that a moment… there’s likely no way you would even think of doing that, right? You would keep your password(s) secret; hidden from prying eyes; secure…

As long as you do that, having sudo active in a User account is of no consequence. Likewise, even if a User dropped to Super User su - they still need a password to do much than ask for a directory; something a User-level account can do anyway.

I believe you are being overly and unnecessarily paranoid.

That said, you’re the administrator responsible for your system; we can only offer advice to those who will listen.

If paranoia is your thing, have at it. :smile_cat:

Regards.


Of course, a far better approach might be to set up a kiosk mode of some kind wherein you can lock down everything except programs you specifically wish your guests to access.

This however, may be beyond the scope of forum responses.

You could perform an Internet search to have a better understanding of what is involved. Here are a few results from a cursory 30 second search;

Good luck.

2 Likes

No - absolutely not - but I think the topic is going off topic.

In such case as you describe - I’d simply remove the irrelevant networks from the list - one can always add them back.

If you hare having trouble removing them - and that has happened after unsupervised access to the system - you should consider it compromised and thus you need to wipe the system.

On a Manjaro system using NetworkManager - and using elevated privileges you can remove unknown networks manually. They all reside in /etc/NetworkManager/system-connections

Create a standard user - log of your admin user and login as the standard user.

We need internet access to check people in. I don’t consider myself paranoid, I just don’t want to end up having to wipe the computer and start over. It’s a lot of work that I shouldn’t be causing on a “daily driver” laptop. In any case, I guess whatever needs an administrator won’t get done on that user. It does ask for administrator password when I install programs though, so no one can install anything harmful without my permission.

create a dedicated user account - without admin rights
have them use that
so the “danger” doesn’t even come up
easy

perhaps I misunderstood what the objective and the concern was

… describe the actual “challenge” better?

Here is the situation:
I have a personal account which is the administrator account.
I have a work account which is a standard account.

I am on the credential committee for my state political party and we use my laptop to sign people in.
I am also a district representative in the same party, so sometimes I need to let someone else sign people in to handle other matters.

Since this is a work account I need to use it on the regular and there are times when things need to be dealt with that have to do with the computer itself. When I am on the computer it would be nice if I could do that directly as the administrator, since I am the main user. I just don’t want it open for that kind of work at a convention.

but not the only one, apparently
You trust the people who also use it?
Only you can answer that.

If you are worried about safety, use a non privileged (non admin capable) account for all activities.

Just like all the students of a university have their own account - but are not able to become admin.

Why would you want or need to share the use of an admin capable account?

If you need to do admin tasks - log in as the admin - or as a user who has got admin rights.

I can’t see a logical or conceptual problem here. :man_shrugging:

I understand - the use case you describe make sense - I wish you had been more explicit - thus we could have avoided the noise.

So you are having a public computer- which guests use to check in, or you have help you don’t trust explicit - connected to a wifi - and you want that computer to not expose how it connect to the WiFi, perhaps others as well - is that correct ?

I agree - I am independent contractor and offer paid consultancy for small business and individuals - you can contact either me using PM or the Manjaro company Enterprise Services – Manjaro if you want to elaborate on your specific needs and what can be done.