To clarify a bit: There are no "sudo commands", there are only commands that need root privileges to operate correctly and
sudo is the command to obtain them for one command:
sudo simply runs the given command as root (read "sudo" as the imperative sentence "superuser, do something!"). The rules about which users may do this are written down in
/etc/sudoers. On a default Raspbian installation, the default user "pi" has got his permissions from this line:
pi ALL=(ALL) NOPASSWD: ALL
It means: "The user 'pi' on ALL hosts is allowed to switch to ALL users and does NOt have to type his PASSWD when using ALL (read: any) commands". (I used crazy grammar here to retain the order of the line .. a note on why there's a way to distinguish hosts: this way, the same sudoers file can be distributed to multiple machines on a network so the network admin has less work).
It may be that being able to run commands using sudo without issuing an admin password is the point why you think it to be dangerous to use sudo over SSH (I haven't heard of a general problem with doing that ... so could you explain what danger exactly you mean?).
Sure you could have multiple users with different permissions. But I'm afraid that using sudo still is the best way to manage these permissions.
So, I hope this small recipe here is what you need:
$ sudo adduser admin
This will create a user "admin", ask for a password, create his home directory, etc.
$ sudo adduser admin sudo
$ sudo adduser admin adm
This will put the "admin" user into the usergroups "sudo" and "adm". And since permissions are managed in Linux by adding users to usergroups, this gives the "admin" user all privileges and permissions he needs. There is a line in
/etc/sudoers that allows any user that is in the usergroup "sudo" to execute any command as root; and this privilege is what we need for an admin user (adding him to "adm" allows him to read some log files in
/var/log without using
sudo and a few other things). You still need to use
sudo when you're logged in as admin -- but now sudo asks again and again for the admin's password whenever you did not use sudo for about five minutes.
Now log off and log on as the user "admin". Check whether
$ sudo apt-get update
$ sudo apt-get upgrade
works. If it does, you may revoke some privileges of the "pi" user, because you are now sure that your admin user has the right privileges:
$ sudo deluser pi sudo
$ sudo deluser pi adm
This throws the user "pi" out of the usergroup "sudo".
$ sudo visudo
This will start an editor that allows you to edit
/etc/sudoers. Put a hash tag (
#) before the line starting with "pi", commenting it out (or simply remove it). Then save and exit the editor, visudo will then re-load the privilege rules immediately. Now the user "pi" is not allowed to use sudo anymore.
After that, you may re-logon as the user "pi". If you ever want to switch over to the admin for some commands, use
su ("switch user"):
$ su - admin
If you want to add more users: use
sudo adduser <name> like above, then check the list of usergroups the user "pi" has got:
$ groups pi
pi : pi dialout cdrom audio video plugdev games users netdev input
sudo adduser <username> <groupname> to add your new user to several of these usergroups, enabling him to use audio, accelerated video, use pluggable devices, etc. If unsure, add him to all of these usergroups (but not to "sudo"!).