Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a dedicated server on which I run my custom developed website. I don't claim it's the most expensive or important piece of software ever written, still, it's been a lot of hard work to get this working.

Now I'm in a situation where I need to hire a professional administrator to have a look on my mail server (all messages sent from my server get flagged as spam), which will require access to my dedicated server. I'm planning to hire this professional from a freelancing website, like elance.com, which means he's a total stranger.

My question is, is it unwise to give access to your server to a total stranger you hire from the internet? Have you ever given access to your servers to others? Was it through remote desktop? Please share your thoughts and experiences.

share|improve this question

5 Answers 5

I'd have to say yes, it's unwise to give access to a complete stranger off the Internet, especially as a freelancer. A better idea would probably be to contact a local school or business and see what consultants are available in your area to work with.

You have to remember that security comes down to trust. You need to know that this person has complete access to your system and can easily place his own scripts, doctored binaries, etc. on your system without your knowledge, especially if you're not administration-savvy. Nothing is preventing this person from deciding you aren't paying him enough or on time and have a script that states if user XYZ hasn't logged in by a certain date or within X days, "rm -fr /".

If you find someone local, you at least have someone to hold accountable. You also should make sure you have backups of your work on a separate disk under your own control. You can't rely just on backups as the admin works of the system state...if they alter the configs and/or add a little "gift" to the binaries, you'll back them up along with everything else, then end up copying the trojan data along with your other data.

You need to find someone you can hold somewhat accountable or at least is operating a reputable business. Depending on how much you rely on your website for income or reputation or your own business needs, you need to decide how much to prioritize the trust level of your admin.

Have we given access to others? Yes, our school has contracted to an IU (kind of a state agency that supports public schools) but we know the guys that have them and we deal with them on a one-on-one basis. Can they mess us up? Sure they can. So can our own admins, if they're screwed over and treated like dirt and something happens where they leave on bad terms. Again, security comes down to how much you trust your users and how much you separate access to what they absolutely need.

Remote desktop doesn't really help block out a lot of security issues. For example, we have desktop control of our users...what is most valuable? information? If we were so inclined we can see them typing sensitive emails and get information passively, without knowing their passwords. We also have had remote techs operating things like a vendor for our point of sales cafeteria software handle things remotely, so they didn't have our admin password but they did have admin access since I was logged in as an admin. I was also watching what they were doing the whole time, and again we trusted them. Just not enough to work without supervision :-) I also generally know what they're doing. I know there's no reason for them to poke around our shares or install certain software on our server. If you have no idea what system administration entails, watching what they're doing isn't going to help you much. It really only helps if you have some idea of what is and isn't to be fiddled with while the other person is working, and if you're talking about SSH access it's very possible they can get back door access while you're watching something else going on.

I was just reading about an article in Worse Than Failure where a developer was working on a web site and there were disagreements about pay or some other issue and the developer threatened to delete the site, even after the owner changed passwords and information. The developer said he still could do it, so pay up...so the admin did a quick grep and found a stupid statement in the PHP that erased all the files if a certain keyword was in the URL submitted to the web app. It's that simple to have someone screw you over.

Backups, backups, archive and version info your application and data, and find someone you can hold accountable and trust. Your system admin should be someone you're going to form a good business relationship with, not a passing "let's try this" thing.

share|improve this answer
1  
+1 I'm fine with the random guy off the street shoveling the show or cutting the grass - but the cost of making a bad decision in that case is pretty low. –  Kara Marfia Jan 19 '10 at 15:27
    
great link to that story... "Maybe I Needing Later" caused me to laugh hard... thanks for sharing that. –  nicorellius Jan 17 at 0:45

In my opinion the simple answer is if you don't give someone access, they can't help fix the issue. But it is unwise to use a company that you don't trust. Whether its the guy down the street or someone off the web you have to put your trust in someone in order to get the problem fixed.

Many company's like elance.com will have ratings and reviews available for all of their techs, if they don't then find a company that does. You can also find reviews for the company over all. Generally, techs who sign up for these sites are looking to make some extra money and will honestly try to help you. But there's no telling whether they will be able to or not until they get a look at the problem.

But make sure you have a backup... it doesn't hurt to be cautious.

share|improve this answer
    
I generally agree with this approach. While giving strangers access to your server is scary, there may not be a practical alternative. –  Phil Hollenback Jan 19 '10 at 17:52

What OS is this? Can you create a limited account for him that gives access to ONLY what he needs?

I've never given access to a random stranger from the Internet, and never would. I won't even give access to vendors until I have a face-to-face meeting with their technical staff.

Is there a reason why, for something this potentially harmful, you want to use elance instead of finding a local IT consultant who can sit at your desk with you, and let you watch every command they type?

share|improve this answer

You are going to get different answers on this one. But mine is, "It depends". Is it a vendor, then yes, I probably would. A stranger, i would feel a little wary.

If it were a total stranger, and you feel you need to keep an eye on him and its a one time thing? Create a new LogMeIn Free account, give him access and watch from the console as he is logged in, uninstall the software when the work is complete.

share|improve this answer
    
The 'observe' method seems fine, but then my paranoid brain wonders what I'd do if the freelancer logs into my server, pulls up a remote file share, runs UsefulTool.exe, and then deletes it afterward. No way to know what it did, and if it was damaging - well, it's done now. –  Kara Marfia Jan 19 '10 at 15:22

I haven't given access to any of my servers that I manage. But I have been given access on multiple occasions.

I've been given direct RDP, SSh, and one used logmein.com. From a security standpoint, I think the logmein.com service was the best. B/c it was a layer of security before you hit the Windows log-in prompt. If you can't do something like that. RDP will work. And then you can shut off access after the fact.

Since you can't guarantee they won't do any malicious once they are on there. You should take a good inventory of user accounts and services running before you hand over the account. A Full Backup is always a good idea also.

When he is done, you can disable the account. Then you can compare you new server state with the inventory you took. You can also do a file search in Windows or Linux and search by the date modified to see what files they touched.

Another step you can take is give them very basic user rights, no administrator. Then escalate the privileges they need as the dive into the problem. The problem with doing this is it will cost you b/c it will take longer to troubleshoot the problem.

share|improve this answer
1  
I don't know about the privileges escalation as needed...if the user asking for the admin doesn't have any clue what to do, how does he know what's needed? Plus the admin will keep running into brick walls as he's working on the issue(s), making the cost go up as it takes more work and time to fix issues. But you already mentioned this. The user may be best left to re-examine a separation of services...he mentioned email issues but runs a website. If not looking for an overall administrator for everything, try running a virtual mail server and just give admin privs to that machine. –  Bart Silverstrim Jan 19 '10 at 15:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.