Skip to content

Commit fd61efd

Browse files
authored
Update security.md (raspberrypi#1092)
* Update security.md I was going using the documentation myself and noticed some of the commands didn't have the intended effect, you'll see why. * Update security.md * Update security.md
1 parent f0ec13b commit fd61efd

File tree

1 file changed

+13
-7
lines changed

1 file changed

+13
-7
lines changed

configuration/security.md

+13-7
Original file line numberDiff line numberDiff line change
@@ -40,21 +40,27 @@ You will be prompted to create a password for the new user.
4040

4141
The new user will have a home directory at `/home/alice/`.
4242

43-
To add them to the `sudo` group to give them `sudo` permissions:
43+
To add them to the `sudo` group to give them `sudo` permissions as well as all of the other necessary permissions:
4444

4545
```bash
46-
sudo adduser alice sudo
46+
sudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,gpio,i2c,spi alice
4747
```
4848

4949
You can check your permissions are in place (i.e. you can use `sudo`) by trying the following:
5050

5151
```bash
52-
sudo su
52+
sudo su - alice
5353
```
5454

5555
If it runs successfully, then you can be sure that the new account is in the `sudo` group.
5656

57-
Once you have confirmed that the new account is working, you can delete the `pi` user. Please note, though, that with the current Raspbian distribution, there are some aspects that require the `pi` user to be present. If you are unsure whether you will be affected by this, then leave the `pi` user in place. Work is being done to reduce the dependency on the `pi` user.
57+
Once you have confirmed that the new account is working, you can delete the `pi` user. In order to do this, you'll need to first close its process with the following:
58+
59+
```bash
60+
sudo pkill -u pi
61+
```
62+
63+
Please note that with the current Raspbian distribution, there are some aspects that require the `pi` user to be present. If you are unsure whether you will be affected by this, then leave the `pi` user in place. Work is being done to reduce the dependency on the `pi` user.
5864

5965
To delete the `pi` user, type the following:
6066

@@ -81,7 +87,7 @@ sudo nano /etc/sudoers.d/010_pi-nopasswd
8187
and change the `pi` entry (or whichever usernames have superuser rights) to:
8288

8389
```bash
84-
pi ALL=(ALL) PASSWD: ALL
90+
alice ALL=(ALL) PASSWD: ALL
8591
```
8692

8793
Now save the file.
@@ -113,13 +119,13 @@ sudo nano /etc/ssh/sshd_config
113119
Add, edit, or append to the end of the file the following line, which contains the usernames you wish to allow to log in:
114120

115121
```
116-
AllowUsers edward andrew charles anne
122+
AllowUsers alice bob
117123
```
118124

119125
You can also use `DenyUsers` to specifically stop some usernames from logging in:
120126

121127
```
122-
DenyUsers harry william
128+
DenyUsers jane john
123129
```
124130

125131
After the change you will need to restart the `sshd` service using `sudo systemctl restart ssh` or reboot so the changes take effect.

0 commit comments

Comments
 (0)