I want to create an account on my own server for a friend who wants to use weechat.I have created an account adduser friend and created an ssh pair for his login such that password login is disabled.I trust the friend to not try and destroy my system but I am wondering what additional security measures I should take. It can always happen that his account gets compromised.He does not have sudo rights at the moment, which he does not need. Actually, all he needs is to execute weechat in tmux.As it currently stands he can navigate system directories but not remove anything. He can also browse other users' home directories.Is there any recommended additional setup I can do to make his account as safe as possible in case of being compromised?I have read about unprivileged accounts but that seems to be too restricting because he requires a home directory for weechat. To disallow him to read into my home directory I had read about modifying the permissions on all the other home directories. However, I think there should be a way to modify his account instead of all the other home directories?
User to run weechat over ssh
permissions