I have a box I am dedicating to Debian developer access. I am currently
looking for ideas on how to make the system a little more secure for
those developers that need root access. Of course, building a zone is
the first thing that comes to mind but I'm thinking that it's not hard
to automate building of lightweight zones such that we could have a zone
per developer. The process might go something like:
% ssh dev_name@testbox
dev_name@testbox % need_zone
root@dev_name # ...
dev_name@testbox % release_zone
Where need_zone is a SUID script that looks something like:
---
if [ zone does not exist ]
build/install zone from a cloned filesystem
echo $InternalIP $ZoneName >> /etc/hosts
cp ~/.ssh/authorized_keys /$ZoneRoot/root/.ssh/
zfs snapshot $ZoneFS@installed
fi
if [ zone not running ]
boot zone
fi
ssh root@$ZoneName
---
and release_zone is something like:
---
if [zone is running ]
halt zone
fi
rollback zone filesystem to installed state
---
This provides a developer with root access to a Nexenta instance that
can be easily cleaned up and will prevent developers from stepping on
each others toes.