I am hiring a freelance Server Admin (who is more experienced than me - that's why I am hiring them) to do some work on my CentOS-running VPS. They will require root-level access to the server, as they need to install server daemons and such.
What's the best practice in this scenario: how can I identify if the contractor goes and install root kits or does something otherwise nasty? What I have done is created a new account for the user, added the new account to group "wheel", and then used visudo to enable the group wheel to run all commands.
Are there any other steps I should be taking? I accept that by handing over sudo privileges the contractor could pretty much do whatever they want and the end of the day I need to trust them; I guess I at minimum want to make sure I have a record of whatever they do, just in case.