Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to contract a System Admin to configure my running EC2 instance.

For him to set everything up he will need my server IP address, my key.perm and root access.

I though of setting up a new elastic IP address that I can change afterwards so that he can't access the server anymore after his work is done. But I am unsure if he can get the Public DNS meaning the full xxx. compute.amazonaws.com address once in the server?

I was wondering what's the best way to contract someone to setup your EC2 instance via SSH while taking care of your security?

share|improve this question

closed as primarily opinion-based by Iain, Jenny D, squillman, Dave M, mdpc Oct 1 '13 at 20:08

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Create a temporary user with key and give to your admin ,once the admin work is done disable the user. –  Abhishek Anand Amralkar Oct 1 '13 at 9:28
    
@AbhishekAnandAmralkar Could you point me to a tutorial or something on how to do what you describe? –  Jonathan Thurft Oct 1 '13 at 9:30
add comment

3 Answers

Run below commands in your shell

  1. adduser test
  2. su test
  3. ssh-keygen -t rsa
  4. chmod 700 .ssh
  5. cd .ssh
  6. touch authorized_keys
  7. chmod 600 authorized_keys
  8. cat identity.pub >> authorized_keys
  9. rm identity.pub

Replace identity.pub with your pub file name.

Also add user in SUDO list by adding it in /etc/sudoers files.

share|improve this answer
add comment

Above all, you have a contract written up stating that the contractor is responsible for doing x,y, and z and also any damages he or she may cause.

You should also only work with a professional contractor that you can trust.

Finally, add a separate user for the contractor. Provide that user with sudo access and give the login credentials to the contractor.

Once work is done, delete the account.

After the account is gone, perform a full system audit to ensure the contractor did not leave any back doors (extra user accounts, strange services, etc).

You are giving someone the proverbial keys to the kingdom.

You need to be able to trust this person... and have legal redress means should anything happen.

share|improve this answer
    
I want to be up front and honest and candid here: If one does not know how to setup ssh keys and accounts, then setting up any Technical means of preventing a malicious contractor WITH ROOT from doing whatever the contractor wants to the server is likely outside the client's abilities. THIS is why trust is important. And if trust fails, having legal means to recover damages. –  lVlint67 Oct 1 '13 at 13:09
add comment

You can change the key pair he/she was using to connect to your instance, see Amazon guide to do so http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#replacing-lost-key-pair

PS: quoted from Amazon docs "This procedure isn't supported for instance store-backed instances or instances whose root volume has an AWS Marketplace product code."

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.