Do it and share it with friends and family! You will never regret it. Once you start and get the hang of things it's easy and flexible.

Only way is to run to Lichess

Well my other comement saying this is exactly what i need did not get posted as a reply to your comment, my mistake. I followed rhe example for "/usr/bin/wg/" intending to be able to use

wg show

but it still requires sudo. I tried rebooting and nothing changed, any ideas? I did

type -a wg

to get the command location for the sudoer file.

Thank you

This does seem to be exactly what i am looking for. I implemented this and tested it and the command still isn't working yet but i will keep troubleshooting, its probably a silly quirk on my end. Thank you very much!

Thank you for the info! This is very helpful to me.

I am aware that opening / forwarding ports are attack vectors and they become unavoidable though if i need the vpn and ssh capability, however, in theory the ssh port could be closed/not forwarded if traffic/connection was tunneled through the VPN. Those are my thoughts

Thank you

Honestly i never see any resistance to these kinds of steps forward

What you proposed with sgid sounds like it might be what i need. All of the users are controlled my me, it's just when they connect to the smb share of the main system from other devices, i figured it was good security to use an account that is separate from my main account on the system, so they can't access the entire system or execute sudo commands

But what if user A in a new group creates dir "abc" - will dir "abc" automatically be set to the correct group? I would think the group permission would be just like the user permission, not set until manually set.