-1

Outside contractor says they need read/write/execute permissions on part of the filesystem so they can run a script.

I'm ok with that, but I want to know what they're running, in case it turns out there is some nefarious code. I assume they are going to upload the file, run it, and then delete it to prevent me from finding out what they've done.

How can I find out exactly what they've done? My question specifically asks for a way of automatically copying the file, which would be one way. But if you have another solution, that's fine.

For example, if the file could be automatically copied to /home/root/uploaded_files/ that would be awesome.

Improve this question
3
  • you could always run rysnc in a cron job set to run every minute I guess. Personally, it sounds pretty fishy that you think they will try and prevent you from knowing what they've done. Either the contractor shouldn't be trusted or you're paranoid.
    – TheCleaner
    Nov 14, 2012 at 22:49
  • Better to be paranoid than screwed over. How do you ever know you can trust a contractor. I am pretty sure they will upload a script, run it, then delete it. I just want to know what it does, so I can be SURE I can trust them.
    – Buttle Butkus
    Nov 15, 2012 at 2:36
  • This sounds like you're trying to find a technical solution to a social/business problem. Can't you tell the contractor to take a hike if they won't let you verify what they're going to do?
    – cjc
    Nov 16, 2012 at 19:02

3 Answers 3

Reset to default
1

I would definitely consider chroot'ing that contractor. Better yet, find out what they are doing and what it will/may affect. I would never grant priv to a third party to run a script without proper documentation, business case, and sign off.

Hindsight is 20/20

Improve this answer
3
  • I 2nd this. Definitely put them in a chroot'd environment. Why exactly do they full read, write, exec permissions anyhow?
    – laebshade
    Nov 15, 2012 at 5:02
  • It wouldn't be FULL rwx, just in a set of folders and files whose group they belong too. So I don't think the script would be able to ruin anything outside of that area anyway. But they want to run a script that will examine that part of the filesystem. I don't know the details, but I want to be able to look at the code they upload before they delete it. Otherwise, they'll upload, run it, and then probably delete it and I'll never know what really happened.
    – Buttle Butkus
    Nov 15, 2012 at 5:59
  • Also, it's a testing server and I don't think any modifications will be directly copied to production. BUT, suppose their script inserts malicious tracking code into some file. I would like to know that know, before we use them for any work on the production server!
    – Buttle Butkus
    Nov 15, 2012 at 6:00
0

Execute permissions on a file means it can be executed, but execute permissions on a directory means the user can browse directory contents.

Are you sure they're trying to execute a file they're uploading via FTP? It sounds to me that they've got a script that needs to be able to get a directory listing (which they cant do unless they've got execute permissions on that directory).

Improve this answer
0

I am quoting... "suppose their script inserts malicious tracking code into some file. I would like to know that know, before we use them for any work on the production server!"

You need procedures to prevent this type of thing happening. Code review comes to mind. If I was in your shoes, I would tell the contractor to submit the code for review, prior to being granted access.

Dev environments should normally be totally separate from production and access to production systems should be very restricted. If you are worried about code leaking into production from dev/testing systems without knowing it, that is a serious issue that your organization needs to address. If you are bound by compliance, such as PCI, dev separation is a critical requirement.

Improve this answer
1
  • The testing server is totally separate from the production server. Nothing would "leak" except the script performed unknown operations on the testing site and then some of the infected files were copied over to the production site. As long as I'm able to examine their code, I'll be able to tell if it does anything like that.
    – Buttle Butkus
    Nov 17, 2012 at 1:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .