Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We've recently hired an outside programmer to develop some new backend systems for us. He's requested SSH access into our webserver. We've worked with him for years and I trust him as much as any in house employee so I'm not worried about him breaking anything on purpose. But what permissions should he be given? What's a good policy for allowing an outside contractor work with your server assuming he'll be needing a lot of permissions. Ideally I'd like to give him all the powers of a root except changing other people's passwords but not sure if this is even possible.

share|improve this question
add comment

4 Answers

Good policy is always give permissions to only what is needed, but that may be lot of administrative overhead. Explore sudoers file (/etc/sudoers) to get started and you can post specific questions for what permissions you would like to grant.

share|improve this answer
add comment

Well, since you can give him the powers of root, what you could do could be rather to track what he does than to limit. Changing passwords will be one of the less problematic things because, after all, you'll know it quite fast.

You could provide him access with a normal user and then allow that user to execute the commands he needs using sudo. Ideally, you will not allow him to do things like sudo su another user, because that way you'll not see him tracked anymore.

Also, consider having the log of his commands sent to another server, so he'll not be able to hide his tracks fully.

share|improve this answer
add comment

I've set up separate chrooted environments for outside contractors, so that they cannot get into our files even if the permissions are wrong somewhere. SSH has a chroot option that can be used for these occasions. You can even specify a certain user group that gets a chrooted login.

Your mileage for trusting contractors may vary, but I'd play it on the safe side, and offer access to exactly what is needed, nothing less, nothing more.

share|improve this answer
add comment

Start out with giving him normal user access and expand upon that as he needs it. Sudo will be the tool of choice for that. It allows for selective root rights with his own password and it logs everything that gets invoked.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.