[OT] sudo: restrict to physical console only?
Is it possible (how?) to restrict a user to only be allowed to make use
of its sudo usage permission if working at the physical console, not
granting to this user sudo permission when i.e. logged in via ssh? To
keep it simple, I could imagine to even have all sudo for all users
deactivated automatically as soon as a remote connection by ANY user is
detected.
The idea behind this: I have the root account already deactivated, and
am using in principal only one main user who also has the sudo
permissions for being able to do all the system administration, exactly
as Debian was setting this up automatically during the system
installation. If I now this main user ssh access to the system, then I
would like to asure that some security is in place, at least concerning
such simple restrictions like not offering sudo. Coming physically back
to the system could then be checked in the log files if meanwhile
unwanted ssh login or activity took place because I assume that at least
the log files cannot have been manipulated.
Reply to: