We currently maintain several linux servers and are looking to employ sub contractors. However, we wan't to keep tabs on who does what on each server. Other then creating sudo accounts on every server, is there a centralized user management system that a user must log into and then are able to access or send commands to certain systems?

  • You could roll your own proxy console server and capture the history files from each session. – schroeder Jul 9 '13 at 20:18

Sounds like you require a centralised authentication system and a centralised audit system for monitoring.

You could configure a LDAP server for centralised authentication using the Linux PAM module. This server would manage Role Based Access Control and sudo permissions across systems.

For logging user activity, you could use something like snare, splunk, logstash etc for log shipping from each of the systems being worked on. You could search based on user or system to identify user activity and commands being run.

| improve this answer | |

This is too complicated a question to answer here - even if you had told us what the sub-contractors were doing.

Do you have management tools in place? (you might want to have a look at puppet and Canonical's landscape).

Suppose you had the facility to record every action by every sub-contractor - do you the capacity and skills to audit that?

Depending on what they were employed to do, I'd let them do anything they want on a machine assigned to them, but require them to check in any and all changes into a central, managed version control system - and wipe / rebuild the systems from the version control at least once a week.

| improve this answer | |
  • 1
    I'm not sure that this is helpful, and even comes off as a little insulting to the OP. It is not too complicated, he is asking about pre-established approaches to Linux administration, something that is a very real question in Linux security. – schroeder Jul 9 '13 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.