From cd900667cb0aa8008f9335ad0bc2437023ad68e9 Mon Sep 17 00:00:00 2001
From: AJ ONeal <aj@therootcompany.com>
Date: Thu, 25 Jun 2020 06:50:46 +0000
Subject: [PATCH] update ssh-adduser

---
 ssh-adduser/README.md    | 51 +++++++++++++++++++++++++++++++++++++++-
 ssh-utils/ssh-adduser.sh |  3 ++-
 2 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/ssh-adduser/README.md b/ssh-adduser/README.md
index 804a1fb..133d22b 100644
--- a/ssh-adduser/README.md
+++ b/ssh-adduser/README.md
@@ -5,5 +5,54 @@ tagline: |
   SSH adduser: Because friends don't let friends login or run stuff as root
 linux: true
 description: |
-  Many modern web programs (`npm` and `postgres`, for example) will not function correctly if run as root. `ssh-adduser` adds user `me` with the same **`~/.ssh/authorized_keys`** as the `root` user, with a long random password, and gives `me` `sudo` privileges.
+  Many modern web programs (`npm` and `postgres`, for example) will not function correctly if run as root.
+
+  `ssh-adduser` will
+
+    1. add the user `me`
+    2. sets a random, 32-character password (as a failsafe)
+    3. copy the `root` user's **`~/.ssh/authorized_keys`** (so the same users can still login)
+    4. gives the `me` user `sudo` (admin) privileges
+    5. allows `me` to `sudo` without a password
 ---
+
+How to create a new user named 'me':
+
+```bash
+# Note: --disable-password means that the user cannot yet login
+adduser --disabled-password --gecos "" me
+```
+
+How to create a and set a random password:
+
+```bash
+# store a random 16-byte password into 'my_password'
+my_password=$(openssl rand -hex 16)
+
+# use 'my_password' to set the user 'me's password
+printf "$my_password"'\n'"$my_password" | passwd me
+```
+
+How to make the user 'me' a "sudo"er (an admin):
+
+```bash
+adduser me sudo
+```
+
+How to allow 'me' to run sudo commands without a password:
+
+```bash
+echo "me ALL=(ALL:ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/me
+```
+
+How to copy allowed keys from root to the new user:
+
+```bash
+mkdir -p /home/me/.ssh/
+chmod 0700 /home/me/.ssh/
+
+cat "$HOME/.ssh/authorized_keys" >> /home/me/.ssh/authorized_keys
+chmod 0600 /home/me/.ssh/authorized_keys
+
+chown -R me:me /home/me/.ssh/
+```
diff --git a/ssh-utils/ssh-adduser.sh b/ssh-utils/ssh-adduser.sh
index 250cc7e..b9da2ec 100644
--- a/ssh-utils/ssh-adduser.sh
+++ b/ssh-utils/ssh-adduser.sh
@@ -25,7 +25,8 @@
     echo "me ALL=(ALL:ALL) NOPASSWD: ALL" | tee /etc/sudoers.d/me
     sudo -i -u me bash -c 'ssh-keygen -b 2048 -t rsa -f /home/me/.ssh/id_rsa -q -N ""'
     mkdir -p /home/me/.ssh/
-    cp -r $HOME/.ssh/authorized_keys /home/me/.ssh/
+    chmod 0700 /home/me/.ssh/
+    cp -r "$HOME/.ssh/authorized_keys" /home/me/.ssh/
     chmod 0600 /home/me/.ssh/authorized_keys
     chown -R me:me /home/me/.ssh/
 
-- 
2.25.1