Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I have to give root access for a third-party sysadmin to do some work on my Linux severs, but I would prefer not to give them full root access.

What I'm thinking is that I could create a PHP script which would login via SSH, and therefore not require having to give the root password to the sysadmin. This way I could also easily log everything they do, to ensure they don't give themselves a backdoor, install something malicious, or attempt to access customer information from the databases.

So my questions are:

Do you think I am wise to be concerned about this? Or there another standard way of dealing with this issue? (Or perhaps no issue at all?)

I understand that PHP supports SSH functionality. Any open-source implementation that exists already for what I want? Is there anything else I need to consider?

share|improve this question
1  
The proper way to do this would be to set him up with an account that gives him access to only what he needs and jsut let him use SSH. For that reason Im going to vote to close and move to server fault. You should also reword your question to ask how to give someone limited administrator access on a box. Be sure to mention the tasks he needs to perform so they can help you get the configuration right. – prodigitalson Feb 13 '12 at 3:14
php is really not the best way even though it has several ssh2 functions, better way would be to give chrooted ssh access. – Vamsi Feb 13 '12 at 3:15
1  
You have to meet someone for the first time before you can get to know them in order to trust them. I don't know any experienced sysadmins, so I have to use one that I do not know well enough to trust. – Alasdair Feb 13 '12 at 3:20
2  
You realize with all the work you are going to have to put into this script you could just perform these tasks yourself? – prodigitalson Feb 13 '12 at 3:21
1  
phone\skype\ shared screen he tells you what to type, you type, then you both see the output. suckey but could work. – Dagon Feb 13 '12 at 3:23
show 3 more comments

migrated from stackoverflow.com Feb 13 '12 at 20:56

2 Answers

up vote 0 down vote

This is exactly what sudo is for. You needn't give him the root password. Instead, you give him liberal sudo access to do what he needs, which logs all his activity.

share|improve this answer
up vote 0 down vote

If you use a php script or sudo (I prefer this second solution), a malicious sysadmin has rights equivalent to root so he could modify also the logs of sudo commands. In order to solve this problem, you can configure the linux box to send all the log to a remote log server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.