Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Hi, I would like to trial some dev ops/sysads/db admins but I don't want to give them the keys to the kingdom until they've proven their skillz.

I'd like something analgous to TeamViewer in the sense that I would manually allow a particular session and they wouldn't be a user of the system. I would type in passwords on sudo'd commands where necessary.

Searching for this I see much talk about tmux and screen but these seem to about existing users choosing to share sessions at will. I'd rather not have to create low access users and clean out my permissions.

We're running Centos 6.

Any suggestions?

share|improve this question

migrated from stackoverflow.com Feb 12 '13 at 9:03

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers 2

Well if you have a GUI installed you can just install a vncserver. Even Teamviewer itself will probably work (yes, there is a linux version).

But from a perspective of security: Why not create a new user (I mean it's one command, not that this is any work) and then control via the sudoers file what he is allowed to do. It even logs the users actions. So in case the user breaks something you have at least evidence.

share|improve this answer
add comment

Short Answer

No.

Long Answer

Such a session would still have to be tied to a user with enough privileges to make the changes your candidates would need to prove their "skillz".

You shouldn't even want to let untrusted outsiders touch sensitive machines, even if you could monitor them in real time as they worked. Anyone who does

You shouldn't even want to let untrusted outsiders touch sensitive machines, even if you could monitor them in real time as they worked. Anyone who does hasn't been paying attention to their CVEs. As I write this, there have been 10 local Linux kernel vulnerabilities in just the past 3 months. (You may get a different number of results clicking that link at a later time.) For the most part, all you need to exploit these is to have the ability to run commands as a normal user on a system with the affected feature enabled.

I suggest that if you have to see if someone can do a sysadmin job, that you set up a VM, give the prospect full root permissions on it, and let them loose.

If you're trying to see if they can fix things, set up the VM in a working state, purposely damage the VM, then set another snapshot before giving it to them. This will let you roll back to the damaged state for the next candidate, or roll back to the pristine state to set up a different form of damage. Some VM systems let you set up a "tree" of such scenarios, with different VMs branching off at different points from prior copies.

If you're trying to see if they can set up a particular service, install a clean copy of the OS either with the service in its default state or not installed at all. Then as before, take a snapshot before giving the prospect access to the VM.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.