One example I've used was setting up some non-technical windows users with a shortcut they could click which would:
do a key-based, passwordless ssh login to the server rotate a proxy log, specific to their test machine
The logrotate config for these logs included code to move a copy to a mapped network share.
So clicking the shortcut caused the log for their most recent bout of testing to magically appear in a folder on their desktop.
The sudoers file allowed only this command to be run by these users. They did not get shell access at any stage.
One example I've used was setting up some non-technical windows users with a shortcut they could click which would:
do a key-based, passwordless ssh login to the server rotate a proxy log, specific to their test machine
The logrotate config for these logs included code to move a copy to a mapped network share.
So clicking the shortcut caused the log for their most recent bout of testing to magically appear in a folder on their desktop.
The sudoers file allowed only this command to be run by these users. They did not get shell access at any stage.