如何“安全地”允许其他人在我的服务器上工作？

Question

I sometimes have a need to pay someone to perform some programming which exceeds my expertise. And sometimes that someone is someone I might not know.

My current need is to configure Apache which happens to be running on Centos.

Giving root access via SSH on my main physical server is not an option.

What are my options?

One thought is to create a VPS (guest as Linux) on my main physical server (operating system as Linux) using virtualbox (or equal), have them do the work, figure out what they did, and manually implement the changes my self.

Seem secure? Maybe better options? Thank you

Answer 1

I suggest looking into the chroot command. chroot() changes the root directory of the calling process to that specified in path. This directory will be used for pathnames beginning with /. The root directory is inherited by all children of the calling process.

This implications of this, are that once inside a chroot "jail" a user cannot see "outside" of the jail. You've changed their root file. You can include custom binaries, or none at all (I don't see why you'd want that, but point being YOU decide what the developer can and can't see.)

We can use a directory for chroot, or you could use my personal favorite: a mounted file, so your "jail" is easily portable.

Unfortunately I am a Debian user, and I would use debootstrap to build a minimal system to a small file (say, 5GB), but there doesn't seem to be an official RPM equivalent. However the process is fairly simple. Create a file, I would do so with dd if=/dev/zero of=jailFile bs=1M count=5120 . Then we can mkfs.ext4 jailFile . Finally, we must mount and include any files we wish the jailed user to use (this is what debootstrap does. It downloads all the default goodies in /bin and such) either manually or with a tool.

After these steps you can copy this file around, make backups, or move servers even. All with little to no effort on the user side.

From a short google search there appears to be a third party tool that does nearly the same thing as debootstrap , here . If you are comfortable compiling this tool, can build a minimal system manually, or can find an alternative; and the idea of a portable ext4 jail is appealing to you, I suggest this approach.

If the idea is unappealing, you can always chroot a directory which is very simple.

Here are some great links on chroot :

https://wiki.archlinux.org/index.php/Change_root

https://wiki.debian.org/chroot

http://www.unixwiz.net/techtips/chroot-practices.html

Also, here and here are great links about using chroot with OpenSSHServer.

On a side note: I do not think the question was off topic, but if you feel the answers here are inadequate, you can always ask on https://serverfault.com/ as well!

Answer 2

Controlling permissions is some of the magic at the core of Linux world.

You... could add the individual as a non-root user, and then work towards providing specific access to the files you would like him to work on.

Doing this requires a fair amount of 'nixing to get right.

Of course, this is one route... If the user is editing something like an Apache configuration file, why not set-up the file within a private bitbucket or github repository?

This way, you can see the changes that are made, confirm they are suitable, then pull them into production at your leisure.