1

I've got a VPS running Ubuntu 12.04 - I'm not particularly well versed in server management, but can do basic CL stuff.

We've got some third parties (from odesk) working on a web app for us that will be hosted on the VPS as part of the build they need access to the server via ssh to run database migrations and other stuff.

My main concern is that I have no idea what they are actually putting on the server, I believe they are only putting on items concerning the development of the web app, but equally well they could be installing malware in the background.

I plan on installing ClamAV for virus scanning, but if someone has with root access can that be bypassed ?

Is there a best practice to A) protect the server, whist at the same time still giving the third party access and B) Is there a command or somewhere I can see all installed items, so I can see whats actually on there ?

3 Answers 3

4
+50

I plan on installing ClamAV for virus scanning, but if someone has with root access can that be bypassed ?

To scan for what? Windows viruses? Why would you need that? Please read this topic: Do I need to have 'antivirus software' installed? regarding the need for a virus scanner on Linux. But to check for suspicious activities on your system a root kit detector seems more appropriate.

Root kit scanner is scanning tool to ensure you for about 99.9%* you're clean of nasty tools. This tool scans for root kits, back doors and local exploits by running tests like:

  • MD5 hash compare
  • Look for default files used by root kits
  • Wrong file permissions for binaries
  • Look for suspected strings in LKM and KLD modules
  • Look for hidden files
  • Optional scan within plain text and binary files

Root kit Hunter is released as GPL licensed project and free for everyone to use.

  • No, not really 99.9%.. It's just another security layer

Is there a best practice to protect the server, whist at the same time still giving the third party access

Do not give them your admin password. Create a separate user for them with what -you- consider enough privileges. And let them complain to you if they need to do something they can not and then decide to either accept their request or deny it. Denying it might be appropriate if you can do that task yourself.

And when they are done lock that user and change your admin password. When they need access again unlock the user.

Is there a command or somewhere I can see all installed items, so I can see whats actually on there?

No. Not with a fool proof methods anyways. If they used apt-get those are logged. but there is no way to log a script being added to your system (and I would expect these scripts to hide itself amongst the software you allow odesk to install anyways; let's assume they tell you to install 10 files and 9 of them are legit, and 1 of them is an odesk user that wants to install something unwanted... how are you going to find this?).

There is a better method: what you need to do is check traffic and that you can find in /var/log/. If you see (what you believe to be) weird connections, the log files will point you to the culprit. But this is not just for this case: regularly checking traffic is a task any admin should do (malware is only useful if is gets its results out the door so you need to play the gatekeeper).

4

Really good practices would give them as little access as required,

1) Do they need ssh access atall?

If they need to just work with the database then you can open up the database port to their IP or use web management tools eg. PhpMyAdmin. They can request certain packages be installed rather than doing it themselves. If they really need ssh access for some reason then you can loook at SSH Chroot Jails that give limited access to some resources on the system.

2) How to list all programs?

You can list all installed applications installed by the package manager by issuing the command sudo dpkg -l but how do you know they have not just put some binaries on system and bypassed the package manager? or edited cronjobs. You can use applications such as tripwire and finely set this up to test for changes in the system.

It really boils down to a little access as is possibly needed for the 3rd party to do the job. If you give someone root access to the system then in my opinion you can only trust that system as much as you trust the admin you gave access.

1
  1. The first part (SSH & anti-virus/malware) is answered rightly so by Rinzwind & Shutupsquare, so I'd avoid repeating it. I agree to their views and upvoted them for it. Rinzwind's Answer on SSH Shutupsqaure's Answer on SSH & Anti-virus

  2. As for listing of all packages installed locally and save as a text file called 'packages' on your desktop do this in your terminal (you don't require 'sudo'): dpkg --get-selections > ~/Desktop/packages

You should also use Tripwire if you fear your team (or someone) might go on a sabotage-spree.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .