Principle of least privilege

[Vince0789]

Follow the principle of least privilege. A user or service account should not get more privileges than it needs to do its job. Adding it to the sudo'ers group is a very bad idea as it essentially makes the account an admin on the system, when it does not need that privilege at all.

A few considerations of mine:

• Create a service account that will be used to run the server, e.g. svc-omp-server. You could pass the -M flag to skip the creation of a home directory.
• Lock the service account if you don't plan to use it to login usermod -L svc-omp-server
• The useradd command will also implicitly add a group with the same name, with the service account as its sole member
• The server files should reside in /opt, e.g. /opt/omp-server, which is the preferred place for third party apps and packages
• Change the group of the server directory to the service account chgrp svc-omp-server /opt/omp-server
• Set the GID bit on that directory chmod g+s /opt/omp-server
• Permissions for 'others' can be removed chmod o-rwx /opt/omp-server
• Now execute wget etc. in there to download the server files. The group permissions should be automatically inherited by all files and folder because of the GID bit. This means the service account can access and run them. Any new files created in there by anyone should also automatically inherit the correct group.

Any other user that you may want to give access to the directory, you can add into the svc-omp-server group.

[itsneufox]

Thank you for your contribution @Vince0789 I'll take your improvement into consideration and rewrite the documentation.

Also thank you for being so helpful!

[itsneufox]

@Vince0789 Sorry to ping you again. Could you please review the PR when you have a moment and let me know if it needs any enhancements?

Link to the rewritten branch: https://github.com/itsneufox/installation_openmp_ubuntu/tree/Rewrite

Thanks a bunch!