Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to contract a System Admin to configure my running EC2 instance.

For him to set everything up he will need my server IP address, my key.perm and root access.

I though of setting up a new elastic IP address that I can change afterwards so that he can't access the server anymore after his work is done. But I am unsure if he can get the Public DNS meaning the full xxx. address once in the server?

I was wondering what's the best way to contract someone to setup your EC2 instance via SSH while taking care of your security?

share|improve this question

closed as primarily opinion-based by Iain, Jenny D, squillman, Dave M, mdpc Oct 1 '13 at 20:08

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

Create a temporary user with key and give to your admin ,once the admin work is done disable the user. – Abhishek Anand Amralkar Oct 1 '13 at 9:28
@AbhishekAnandAmralkar Could you point me to a tutorial or something on how to do what you describe? – Jonathan Thurft Oct 1 '13 at 9:30

Run below commands in your shell

  1. adduser test
  2. su test
  3. ssh-keygen -t rsa
  4. chmod 700 .ssh
  5. cd .ssh
  6. touch authorized_keys
  7. chmod 600 authorized_keys
  8. cat >> authorized_keys
  9. rm

Replace with your pub file name.

Also add user in SUDO list by adding it in /etc/sudoers files.

share|improve this answer

Above all, you have a contract written up stating that the contractor is responsible for doing x,y, and z and also any damages he or she may cause.

You should also only work with a professional contractor that you can trust.

Finally, add a separate user for the contractor. Provide that user with sudo access and give the login credentials to the contractor.

Once work is done, delete the account.

After the account is gone, perform a full system audit to ensure the contractor did not leave any back doors (extra user accounts, strange services, etc).

You are giving someone the proverbial keys to the kingdom.

You need to be able to trust this person... and have legal redress means should anything happen.

share|improve this answer
I want to be up front and honest and candid here: If one does not know how to setup ssh keys and accounts, then setting up any Technical means of preventing a malicious contractor WITH ROOT from doing whatever the contractor wants to the server is likely outside the client's abilities. THIS is why trust is important. And if trust fails, having legal means to recover damages. – Daniel Widrick Oct 1 '13 at 13:09

You can change the key pair he/she was using to connect to your instance, see Amazon guide to do so

PS: quoted from Amazon docs "This procedure isn't supported for instance store-backed instances or instances whose root volume has an AWS Marketplace product code."

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.