1

I was just seeking some advice on (opinionated?) security concious, best-practices for this situation:

I have an Ubuntu VPS (on Azure) running a couple of websites. These servers are quite hardened for security. I set them up. I am the only developer who has worked on these sites and I have the only SSH login with sudo privileges. If I wanted to provide a contingency plan in case something terrible happened to me (e.g. I die), my client, who has NO ability to manage the server themselves, can get another (currently unknown) developer to take over.

Which of the following would be better?

[1] Create another user with the same privileges as I have and share this with the agency.

[1A] Better with Public Key Authentication, or just a username and password? i.e. if I'm creating and giving the login to someone else, is the key then pointless?

[2] Don't do anything, and instruct the contingency developer to reset the user logins, and possibly have short website down time, with the root account through the Azure control panel in the unlikely event of my untimely death (because there are ultimately less potential vulnerabilities if there are no other account details going around in unsecure communications).

Thanks in advance for your suggestions.

1 Answer 1

0

I would create a user with a strong password, sudo privileges, and set up public key authentication. Configure sudo to require a password and instruct the user to change her password upon the first login.

I would be concerned about just having the contingency developer reset user logins, as users may have encrypted directories that are unlocked using the same credentials as their login.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .