2

N00b here - I'm upgrading my website so that it isn't using a deprecated version of MySql/ PHP. I'm not comfortable enough with the code so I'm using an outside developer.

Due to this being database related I they will need SSH access ... which scares me.

I'm mostly worried about this developer accessing or downloading files that they don't need/I don't want them to.

Are there activity logs when using SSH that shows what files were accessed?

Is there a way to delete the logs?

Aaron Hall
  • 296
  • 3
  • 12
Roberto Frink
  • 21
  • 1
  • 3
    Someone with root access can do basically anything, including covering virtually any tracks they might leave. If you don't have an existing reputable contact (preferably a firm, and preferably in a jurisdiction you can go after in something like small claims court), you may be better off setting up a new server, contracting them to do any development work on the codebase to bring it up to modern PHP (thus controlling what you provide them with), and installing it yourself on the new server. Even there, there's a risk of back-doors. – ceejayoz Apr 15 '19 at 19:33
  • 2
    Is your developer expected to do the system upgrade for you? If so they will probably need sysadmin level acces and then they can do anything and everything. But for inspiration see this Q&A of mine: https://serverfault.com/q/805333/37681 – HBruijn Apr 15 '19 at 19:34
  • Mysql database can be configured to allow direct remote access without need to provide SSH access. Malicious developer can add backdoor while having any access level though... (Backup is your friend) – Anubioz Apr 15 '19 at 19:34
  • @Anubioz If a MySQL (and PHP) *upgrade* is required, as appears to be the case, mere access to run SQL queries won't be sufficient. – ceejayoz Apr 15 '19 at 20:14
  • @ceejayoz I considered the MySQL/PHP versions already to be upgraded on the host for the developer to fix compatability issues with the web app itself (since updating OS for latest software version otherwise might be non-trivial task, usually unsuited for them )) – Anubioz Apr 15 '19 at 20:29
  • 2
    There are not technical solutions to every problem. The solution to this problem is the [NDA](https://en.wikipedia.org/wiki/Non-disclosure_agreement). – Michael Hampton Apr 16 '19 at 01:54

2 Answers2

4

In a password protected area you can install for instance https://www.adminer.org/ or https://www.phpmyadmin.net/ to allow someone access to the database without giving them SSH access, but that won't allow them to upgrade the OS for you.

Almost regardless of how much you trust the developer, make a good backup beforehand of your system, settings and data.

HBruijn
  • 72,524
  • 21
  • 127
  • 192
  • Awesome, thanks for the tips! My biggest fear is that there are around 100GB of proprietary/ trade secret documents in one directory that I don't want the developer downloading. Is there a way to temporary move that folder to somewhere they can't access? Realistically the code changes should only take a few hours so I suppose I could just download the entire folder and delete it from the server. Then upload it again after the fact. But is there an easier way than that? – Roberto Frink Apr 15 '19 at 19:49
  • Frankly, if you've got 100 GB of trade secrets on an out-of-support PHP server, I'd worry less about a particular developer and more about the rest of the Internet. Taking them off the server ASAP would be a good step either way. – ceejayoz Apr 15 '19 at 19:59
  • Thanks! That is a very astute point @ceejayoz – Roberto Frink Apr 15 '19 at 20:12
2

No, you're allowing someone you don't trust to have root access to your servers. which means they can install a rat in the system or mess with it. you can log files accessed and permissions by creating an account and pass for the person but since he will need root access he can log in and then start deleting your monitoring system. which leaves you to square one. i suggest hire a firm that has reputation. hiring a single person from a craigslist ad would be asking for trouble.

ceejayoz
  • 32,469
  • 7
  • 81
  • 105
user3897632
  • 31
  • 4
  • Thanks! The developer would actually be from the company that made the specific platform I need updating. However, they are located in a different country where legal action would be unlikely which is what worries me most. But I think I am being overly paranoid. – Roberto Frink Apr 15 '19 at 20:18
  • my advice is just make a backup copy of the system before access. that way you can restore if there's any issues. – user3897632 Apr 15 '19 at 21:50