Use personal accounts and sudo

Before choosing a tool or writing more code, make the requirement concrete. Each operator has an individual account and key; administrative actions appear in sudo and system logs.

Shared root login hides accountability and increases the impact of a stolen credential. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

A common failure is to share one root key among operators for convenience. The happy path may still work, which makes the mistake easy to miss. create personal accounts, grant the minimum sudo access, and remove access per person without rotating everyone. Keep the first version small enough that every important input and output remains visible.

This supports the module goal: Reduce SSH exposure on the server while preserving a tested recovery path before removing existing access. Capture the request, command, trace, screenshot, test result, or other evidence that proves the result.

Create two operator accounts and verify their login, sudo boundary, logs, and independent revocation. Change one condition on purpose, predict the result, and compare the prediction with what actually happened.