Hello,

We have a user for technical support purpose.
He has access to specific directories, but how can we limit the things he can do.

For example he can, in the same segment do
Or telnet, FTP and else.

In fact we don't want any possibilities of going out of the server for this user.

Maybe the firewall is the right way to deal with this ?

Thanks a lot.

If he has a unique account or is a member of a specific group, then you can use nftables to filter outgoing packets according to the UID or GID of the originating socket. See 'man nft' and https://wiki.nftables.org/. That can limit outgoing connections to specific addresses. Don't forget about allowing DNS and ICMP while tightening things down.

However, in general that is more of a staffing problem than a technical problem. If he cannot be trusted, then he should not be in the network. Or is there something more complex there?

if he could log in as root - he can do anything without any restriction (on that host).
Probably you need a regular user account instead with special sudo rights.

Hello,


Thanks for your answers.

@Turbocapitalist.
He cannot be trusted simply because is an external technical support for our website, and when he works on the server with his specific user (wordpress) we don't seat beside him.
So all servers on the same segment are accessible.

@pan64
He hasn't the root credential

He just has to work on the server, and the wordpress user doesn't have any need to go on the network.

Is it necessary for the user to have direct access to the server? Once Wordpress is setup the rest is usually managed through the admin panel via web browser / web interface. You should also be able to setup users and fine grain their access rights from the same panel.

1 members found this post helpful.

This should be disabled by default. You should not allow this, period.

If he is logging in as root, then he has to have root privilege.

You should not allow telnet or ftp access. If you need ftp then look at sftp.

Then restrict the user access permissions.

To the OP, why don't you log everything that he does. Inspect the log after he has done something.

A user should never be allowed to login as root via ssh. In fact, on most systems that is disabled by default.
The user should have his own account and only be able to login locally or ssh into that.

Then the sudoers file should be carefully configured to allow that specific user to do only those admin tasks you want him to do. It can be done with careful planning.

The sudo log then will log each command he runs and you will have the audit trail needed.
Additionally his .bash_history file will log what commands are run by his user and the default count there is, I think, 1000 entries, although that can be changed.

It is obvious that for his task there must be some level of trust, but the least possible access is the best for security purposes. Giving him root access via ssh is potentially an enormous security breach.

I agree. WP should be administered using the Wordpress admin panel. Disable that user’s ability to access the system any other way.