impermanence

A lot of these problems seem pretty solveable, if you're the admin of the machine (or cloud system) and the user isn't. If you don't want a user to log in as root, disable the root password (or change it to something only you know) and disable root ssh. If you want people to stop sharing the same login and password across all servers, there's several ways to do it but the most straightforward one seems like it would be to enforce the use of a hardware key (yubikey or similar) for login. If people aren't using configuration management software and are leaving machines in an inconsistent state, again there are several options but I'd look into this NixOS project: https://github.com/nix-community/impermanence + some policy of rebooting the machines regularly. If you don't like how users are making use of AWS resources and secrets, then set u

This is a tough problem to solve. I currently use NixOS with impermanence [1] which is one way of solving it. Impermanence, in short, allows you to explicitely opt-in the files and directories that are persisted after each reboot. So while my `~` is not "clean" in the sense that all my config files are in `~/.config`, it is "clean" in the sense that all files in `~` are there for a reason (i.e., `~` is not polluted by the old config/cache of uninstalled packages). [1] https://github.com/nix-community/impermanence