I plan on installing ClamAV for virus scanning, but if someone has with root access can that be bypassed ?
To scan for what? Windows viruses? Why would you need that? Please read this topic: Do I need to have 'antivirus software' installed? regarding the need for a virus scanner on Linux. But to check for suspicious activities on your system a root kit detector seems more appropriate.
Root kit scanner is scanning tool to ensure you for about 99.9%* you're clean of nasty tools. This tool scans for root kits, back doors and local exploits by running tests like:
- MD5 hash compare
- Look for default files used by root kits
- Wrong file permissions for binaries
- Look for suspected strings in LKM and KLD modules
- Look for hidden files
- Optional scan within plain text and binary files
Root kit Hunter is released as GPL licensed project and free for everyone to use.
- No, not really 99.9%.. It's just another security layer
Is there a best practice to protect the server, whist at the same time still giving the third party access
Do not give them your admin password. Create a separate user for them with what -you- consider enough privileges. And let them complain to you if they need to do something they can not and then decide to either accept their request or deny it. Denying it might be appropriate if you can do that task yourself.
And when they are done lock that user and change your admin password. When they need access again unlock the user.
Is there a command or somewhere I can see all installed items, so I can see whats actually on there?
No. Not with a fool proof methods anyways. If they used apt-get those are logged. but there is no way to log a script being added to your system (and I would expect these scripts to hide itself amongst the software you allow odesk to install anyways; let's assume they tell you to install 10 files and 9 of them are legit, and 1 of them is an odesk user that wants to install something unwanted... how are you going to find this?).
There is a better method: what you need to do is check traffic and that you can find in /var/log/
. If you see (what you believe to be) weird connections, the log files will point you to the culprit. But this is not just for this case: regularly checking traffic is a task any admin should do (malware is only useful if is gets its results out the door so you need to play the gatekeeper).