I need to contract a System Admin to configure my running EC2 instance.

For him to set everything up he will need my server IP address, my key.perm and root access.

I though of setting up a new elastic IP address that I can change afterwards so that he can't access the server anymore after his work is done. But I am unsure if he can get the Public DNS meaning the full xxx. compute.amazonaws.com address once in the server?

I was wondering what's the best way to contract someone to setup your EC2 instance via SSH while taking care of your security?

  • Create a temporary user with key and give to your admin ,once the admin work is done disable the user. Commented Oct 1, 2013 at 9:28
  • @AbhishekAnandAmralkar Could you point me to a tutorial or something on how to do what you describe? Commented Oct 1, 2013 at 9:30

3 Answers 3


Run below commands in your shell

  1. adduser test
  2. su test
  3. ssh-keygen -t rsa
  4. chmod 700 .ssh
  5. cd .ssh
  6. touch authorized_keys
  7. chmod 600 authorized_keys
  8. cat identity.pub >> authorized_keys
  9. rm identity.pub

Replace identity.pub with your pub file name.

Also add user in SUDO list by adding it in /etc/sudoers files.


Above all, you have a contract written up stating that the contractor is responsible for doing x,y, and z and also any damages he or she may cause.

You should also only work with a professional contractor that you can trust.

Finally, add a separate user for the contractor. Provide that user with sudo access and give the login credentials to the contractor.

Once work is done, delete the account.

After the account is gone, perform a full system audit to ensure the contractor did not leave any back doors (extra user accounts, strange services, etc).

You are giving someone the proverbial keys to the kingdom.

You need to be able to trust this person... and have legal redress means should anything happen.

  • I want to be up front and honest and candid here: If one does not know how to setup ssh keys and accounts, then setting up any Technical means of preventing a malicious contractor WITH ROOT from doing whatever the contractor wants to the server is likely outside the client's abilities. THIS is why trust is important. And if trust fails, having legal means to recover damages. Commented Oct 1, 2013 at 13:09

You can change the key pair he/she was using to connect to your instance, see Amazon guide to do so http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#replacing-lost-key-pair

PS: quoted from Amazon docs "This procedure isn't supported for instance store-backed instances or instances whose root volume has an AWS Marketplace product code."

Not the answer you're looking for? Browse other questions tagged .