Mh. I think the problem is: There are (at least) 2 fundamentally different use cases for linux/unix systems. One is what I'd call a shell-server. On a shell-se

Mh. I think the problem is: There are (at least) 2 fundamentally different use cases for linux/unix systems. One is what I'd call a shell-server. On a shell-server, I have a bunch of accounts for users, and there are services supplied for these users. There will be /home/tetha, and /home/tetha/share and /home/tetha/http. And then you have some SMB sharing /home/*/share and you login there with your password, Apache serves /home/*/http for the intranet and so on. This is a very common setup at universities, for example. The other thing is what I'd call an application server or a service server (but that name sucks). Here, you have a system and the main purpose of the system is to serve a web page via nginx, or be a postgres node and such. These service-systems tend to be both more controlled, but also simpler. You need to grant a rather small, very known set of users access to these - 10 - 30 usually. And, honestly, these service-level systems tend to have very streamlined permissions, because realistically, shell-access is enough attack profile to be considered root access unless you are very diligent. Shell-servers however are very, very complex to handle. One big shell-server can be overall more complex than many infrastructures around in total.