I have to give root access for a third-party sysadmin to do some work on my Linux severs, but I would prefer not to give them full root access.

What I'm thinking is that I could create a PHP script which would login via SSH, and therefore not require having to give the root password to the sysadmin. This way I could also easily log everything they do, to ensure they don't give themselves a backdoor, install something malicious, or attempt to access customer information from the databases.

So my questions are:

Do you think I am wise to be concerned about this? Or there another standard way of dealing with this issue? (Or perhaps no issue at all?)

I understand that PHP supports SSH functionality. Any open-source implementation that exists already for what I want? Is there anything else I need to consider?

  • 1
    The proper way to do this would be to set him up with an account that gives him access to only what he needs and jsut let him use SSH. For that reason Im going to vote to close and move to server fault. You should also reword your question to ask how to give someone limited administrator access on a box. Be sure to mention the tasks he needs to perform so they can help you get the configuration right. – prodigitalson Feb 13 '12 at 3:14
  • 1
    well full is full, you either trust him or should not be using him. – Dagon Feb 13 '12 at 3:18
  • 1
    You have to meet someone for the first time before you can get to know them in order to trust them. I don't know any experienced sysadmins, so I have to use one that I do not know well enough to trust. – Alasdair Feb 13 '12 at 3:20
  • 2
    You realize with all the work you are going to have to put into this script you could just perform these tasks yourself? – prodigitalson Feb 13 '12 at 3:21
  • 1
    phone\skype\ shared screen he tells you what to type, you type, then you both see the output. suckey but could work. – Dagon Feb 13 '12 at 3:23

This is exactly what sudo is for. You needn't give him the root password. Instead, you give him liberal sudo access to do what he needs, which logs all his activity.

| improve this answer | |

If you use a php script or sudo (I prefer this second solution), a malicious sysadmin has rights equivalent to root so he could modify also the logs of sudo commands. In order to solve this problem, you can configure the linux box to send all the log to a remote log server.

| improve this answer | |

I suggest the following setup:

  • create a normal user to allow your sysadmin to login via ssh
  • install screen apt-get install screen
  • create a multi-user screen session
  • in the session change current user to root with sudo su
  • turn your writelock to off to allow your sysadmin to do his job

This way, you will be able to see what he is doing, but not to control it. You could generaly achieve the same with any screen sharing application. This can be the first step in building trust with your sysadmin. In the same time, you should have a phone call and have him explain what he is doing.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.