3

I work at a company that develops and hosts a small business critical system. We have an "Elastic cloud server" from a professional hosting provider.

I recently got an email from them saying that they've had some problems with their backup solution and that they needed to install a new kernel. And they wanted us to send them the root password so they could do this work. I know that the email came from them. It's not support@hotmail.com or anything like that.

I called them and asked them about this, and they were like "yep, we need the password to do this".

It just seems odd to send the root password over email like this. Do I have any reason to be concerned?

  • 3
    Time to find another provider. – sciurus Nov 26 '13 at 0:13
  • That sure is a bizarre request. To update your kernel means to reboot your server too. A good provider will not need to do anything like this. You control that process. Time to switch? – Matt Nov 26 '13 at 1:00
7

You're right to be cautious as this is an unusual request. Have they provided details on what the kernel update entails - does it contain any vendor-specific modules? Putting aside the security element for one moment, could the update they're proposing cause problems with the software you're running?

I'd recommend finding out what the update involves and if you can apply it yourself. If they can't provide this information, elevate the case to find out exactly why tech support need root privileges on your system.

| improve this answer | |
4

having worked at several hosting providers, i can say there are rare cases when a root password is needed from a customer. this is typically when customer has a dedicated box, and customer has altered root's authorized_keys, so as to remove provider access.

on a VPS, or "elastic cloud server", the provider can access a virtual host directly thru the hypervisor, or underlying root node, so there is no need to acquire password from customer. if the provider admin says this is needed, it is because they are attempting to do something outside of the privilege escallation the company has given the admin (ie. no access to underlying root node).

In short, unless you have a dedicated box, there should be no need to ask for root password from customer for a vps or "virtual" server. just say that you do not allow interactive ssh, only cert based access... and then ask for their public key to add them to pki auth. as it is easier for them to access thru root node, they will most likely just do that instead.

| improve this answer | |
  • When you say "the provider can access a virtual host directly thru the hypervisor, or underlying root node" what mechanism are you suggesting? The virtual terminal / console? If so, won't this still be credential protected? – plasmid87 Nov 13 '13 at 9:35
  • 5
    Yeah. Smells like a bull answer. Yes, they have access to the hypervisor - but upgrading the client on a virtual machine requires accessing it as root. Likely they need some driver updates that are in a newer kernel. That said, the whole thing smells of bad coordination - i the driver update goes wrong, you are stuck. So a ful lbackup must be taken first etc. – TomTom Nov 13 '13 at 9:42
2

I wouldn't let someone touch my root accounts at all, especially an ISP. How do you verify the Integrity of the person behind the keyboard at the other end? Unless you have worked with them for a while, it's a no go. Just my .02.

| improve this answer | |
1

Is the service you pay them for a Managed or Unmanaged service?

If it's managed - they should already have the information they require.

If it's unmanaged - they have no business logging in, especially as root.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.