User management with cronjob [closed]

Question

In my organization, we want to implement a user management standard after an utter chaos. Where we(organization) and the client was able to access root user and they made changes which took down the server. However, the blame came on us for playing with the configuration files.

To resolve any issues in the future we have designed a model and it would be helpful to get inputs whether it's best practice or not.

Step 1 - Root user and non-root users with sudo access

We want to have users in the following fashion -

• Root user -> Either disabled to log in through SSh for security purpose or access only through SSH key and paraphrase. Root account will be only accessible by one member from my team.
• Two non-root users -> One for my team and other for the client.

Step 2 - Non-root users with limited access to the services

These will be individual users having access to only one service.

• Complete access to server - Apache or Nginx
• Complete access to MySQL

We can have more users to handle different services. And no other user can access a different service, except for the allotted service.

Step 3 - Auditing each user's commands in a log file

• We want to run a cronjob which logs each and every command executed on the server by any user.
• We need this to identify who made the changes and when.

For auditing I looked for few solutions and most of them involved to start a command, like script, before starting your work. I want something to run at all the times without any manual intervention. Even when the server reboots.

Please let me know if this is something which we can do or is there any better approach to manage them.

Answer 1

While the idea sounds good, the way you are formulating it, indicates that you have to less knowledge to implement your ideas on a production level. What you ask for, is a Linux crash course about basic user/group facts and additional mechanisms such as SELinux. Imho I think you should get someone for the job to be done.

Update:

1.) Organize responsibility

The situation occoured because of unclear responsiblities. Who really needs a root account? The admin and only the admin. The rest is service. So never ever share root/sudo accounts with someone on a regular base (support excluded).

2.) A non root/sudo user can start and stop certain services, if the admin allows him to do so:

2a.) You could make certain files executable to non root/sudo users with setUID,setGUID

2b.) You could run the users services in the users userspace. Manually install Nginx & Mysql in /home/client and you are done!

3.) When it comes to auditing this, I guess history is enough for the beginning. The users are unprivileged and in your chain of trust.

Answer 2

As the comment said, selinux and auditd, also psacct to see processes run by users, also possibly even puppet or something to enforce configuration. If unauthorized changes are made then puppet would change configuration back to the official good state.