Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a server at a new colocation center half way around the world. They installed the OS for me and sent me the root password, so there's obviously a great amount of trust in them.

However, I'm pretty sure I don't want them to have my root password on a regular basis. And anyway, I intend to only allow key-based login.

On some cases, though, it might be useful to let their technical support log in through a physical terminal. For example, if I somehow mess up the firewall settings.

  • Should I even bother worrying about that?
  • Should I set up a sudoer account with a one-time password that will change if I ever use it?
  • Is there a common strategy for handling something like this?
share|improve this question
up vote 7 down vote accepted

Well, a lot will obviously depend on the specifics of the case, but you should keep in mind that with physical access to the machine, they can practically do anything they want anyway.

The common solution for this is to give them a dedicated maintenance account that has root rights via sudo. Then you can give them the pw when you want them to have root access. If you want to take away root access, just change the pw on the maintenance account. Alternatively, you can keep the password, and enable/disable root rights via the sudo configuration as required.

At any rate you can configure SSH to only allow key-based logins. Then the maintenance account + pw would only be usable for logins at the physical console (even if it is enabled), further restricting the access to the system (if you want to).

share|improve this answer
We do this and it works well. You can add command logging to the maintenance account too if you really want to look and see what has been done – Ryaner Apr 14 '10 at 13:54

We got a similar setup for some external boxes. We keep the root-password secret and only give it out when it's needed, when done we change it. We do not allow root logins via ssh so the password is only relevant when you got physical access.

share|improve this answer

You should buy an option for access via IP-KVM. You will have access to everything, including single-user mode and BIOS.

share|improve this answer
How does that solve the security issues in the original question? – kbyrd Apr 14 '10 at 12:35
Actually, it does not eliminate them completely (sleske is absolutely right here, physical access makes all precautions useless), but mitigates to an acceptable level, when you know for sure that nobody besides you has any right to log in. Any attempt to log in is an intrusion. – minaev Apr 14 '10 at 13:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.