curlssl commands - curl owned by user (my paid administrator)

[baldnut]

Hi,

I have a web server and pay a guy in europe to administrate it because I am unfamiliar with linux.

I can run basic chown commands copy create and move etc but thats about it, my server is running WHM/cpanel so i tend to stay in there as much as possible.

Anyway when using the history command it revealed this:

I have changed the username of his username to "myhelper" to keep his ID Private as he may be doing nothing wrong but i am not sure what he is doing.

933 whereis curlssl
934 php -i|grep ssl
935 du /opt/curlssl/
936 ls /opt/curlssl/
937 h |curlssl
938 history |grep curl
939 cd /
940 ls
941 cd /home/
942 cp -rf /opt/curlssl /home/myhelper/
943 cd /home/myhelper/
944 ls
945 tar -zcf curlssl.tar.gz
946 tar -zcf curlssl.tar.gz curlssl
947 ls
948 chown myhelper:myhelper curlssl.tar.gz
949 passwd myhelper
950 w
951 cd /home/myhelper/
952 ls
953 history |grep ssl
954 ls
955 cd /root/
956 ls
957 vim install_rtm.sh
958 cd prog/
959 l
960 ls
961 cd .
962 cd tm
963 cd ../tmp/
964 ls
965 cd ..
966 cd /opt/
967 ls
968 locate *curlssl*
969 vim /var/cpanel/perl/easy/Cpanel/Easy/OptLib/curlssl.pm
970 cd ..

Hi username is an account he has created but he is logging in as root with root user and password.

Is anything going on that i need to be concerned about in your opinions?

Thanks

Rob

[Lazydog]

Doesn't look like he is doing anything wrong. Don't know what he did with the 2 files he edited though. Basicly he looked for a file, seen how much space it used, checked history for a command, copied a file to his home dir and unpacked it, set his user as owner of said file, switch to root dir and edited a file (don't know why or what was done here) then cd to /opt and edited a file there (again, don't know why or what was done here).

I don't know how he is logging in, but I would question why he is using root and not his account.

If you question anything, you should question what was changed in those 2 files. Do you have any accountability setup, where he tells you what he is doing before he does it?

Bottom line is if you do not trust him then you need to block him and either learn Linux or find someone you do trust.

[baldnut]

many thanks for your reply.

I had asked him to look into space problem as i keep getting emails from the system saying

Drive Warning: /dev/root (/) is 88% full

I tell him and he does something and then the messages stop but within a few more weeks i start getting the same error message again.

I have masses of space in the server so not sure what is taking up the room but without getting too far off topic im not sure if this is what he is working on?

Many thanks for your time

Rob

[Lazydog]

I question what is writing to '/' then. Goto the CLI and type in 'df -h' This will show you how the disk is broken down with size and how full each is. Maybe you don't have as much space as you think.

[baldnut]

I question what is writing to '/' then. Goto the CLI and type in 'df -h' This will show you how the disk is broken down with size and how full each is. Maybe you don't have as much space as you think.

Filesystem Size Used Avail Use% Mounted on
/dev/md1 20G 17G 1.9G 90% /
/dev/md2 668G 144G 491G 23% /home
/dev/shm 2.0G 0 2.0G 0% /dev/shm
/usr/tmpDSK 485M 12M 448M 3% /tmp


Didnt realise about partitions I had 700gb but thought was all one partion so to speak :S

would any of my hosting accounts effect dev/md1 ? or would all of home generally just sit in md2 which is the bigger partition?

Thanks again.

Rob

[Lazydog]

/home sits on /dev/md2. As to your hosting accounts affect md1, yes they could. I don't know how you have your system setup or what you are doing so to say what is taking up room on md1 you will have to ask your admin. He should be able to give you this information.

[baldnut]

/home sits on /dev/md2. As to your hosting accounts affect md1, yes they could. I don't know how you have your system setup or what you are doing so to say what is taking up room on md1 you will have to ask your admin. He should be able to give you this information.

Many thanks Robert i appreciate your time. I will ask him for a breakdown of the bigger lumps of the 17gb.

Have a good new year

Rob