We've recently hired an outside programmer to develop some new backend systems for us. He's requested SSH access into our webserver. We've worked with him for years and I trust him as much as any in house employee so I'm not worried about him breaking anything on purpose. But what permissions should he be given? What's a good policy for allowing an outside contractor work with your server assuming he'll be needing a lot of permissions. Ideally I'd like to give him all the powers of a root except changing other people's passwords but not sure if this is even possible.
Add a comment
|
4 Answers
Good policy is always give permissions to only what is needed, but that may be lot of administrative overhead. Explore sudoers file (/etc/sudoers) to get started and you can post specific questions for what permissions you would like to grant.
Well, since you can give him the powers of root, what you could do could be rather to track what he does than to limit. Changing passwords will be one of the less problematic things because, after all, you'll know it quite fast.
You could provide him access with a normal user and then allow that user to execute the commands he needs using sudo. Ideally, you will not allow him to do things like sudo su another user, because that way you'll not see him tracked anymore.
Also, consider having the log of his commands sent to another server, so he'll not be able to hide his tracks fully.
answered Aug 1, 2011 at 21:14
I've set up separate chrooted environments for outside contractors, so that they cannot get into our files even if the permissions are wrong somewhere. SSH has a chroot option that can be used for these occasions. You can even specify a certain user group that gets a chrooted login.
Your mileage for trusting contractors may vary, but I'd play it on the safe side, and offer access to exactly what is needed, nothing less, nothing more.
Start out with giving him normal user access and expand upon that as he needs it. Sudo will be the tool of choice for that. It allows for selective root rights with his own password and it logs everything that gets invoked.
