The best practice for managing shared accounts is to lock the shared account.
Rather than managing access to a shared account - which is bad for many reasons, you should add all of your developers to a group (ie.
app_development), testers to another group (ie.
app_testing), etc. Once you have users (each of which is only used by a single person) placed in groups according to the jobs and/or tasks they are currently doing, grant the groups appropriate permissions for the files.
For this example, a software developer employed to develop webapps would belong to
web_development (a developer working on local applications might belong to
application_development rather than
web_development). A tester/QA member of the team would belong to
Users in group
wheel always have permission to read and write via root (unless you're directly limiting their access to it with SELinux).
mkdir -p /home/software_development/web_development/staging`
POSIX Access Control Lists
Make a directory structure for collaboration, giving minimum permission to groups
chown -R root:software_development /home/software_development
chmod 550 /home/software_development
setfacl -m g:software_development:r-x /home/software_development
setfacl -m g:software_testing:r-x /home/software_development
chown -R root:web_development /home/software_development/web_development
chmod -R 2570 /home/software_development/web_development
setfacl -R -m g:web_development:rwx /home/software_development/web_development
setfacl -R -m d:g:web_development:rwx /home/software_development/web_development
setfacl -m g:web_testing:r-x /home/software_development/web_development
setfacl -m d:g:web_testing:0 /home/software_development/web_development
setfacl -m d:g:web_testing:r-x /home/software_development/web_development/staging
setfacl -R -m d:u:root:r-x /home/software_development
root and anyone in the groups
software_testing can get into
/home/software_testing and see its contents.
web_developers can see and modify the contents of
/home/software_development/web_development and all subdirectories (both ones that currently exist and all that may be created in the future).
web_testers can see the direct contents of
/home/software_development/web_development, but not any subdirectories except for
- Note that
software_testing have no write access whatsoever - as they do not need it to do their jobs.
It is important that the web developers understand that their projects should be placed within a subdirectory of
web_development (usually a project name: ie.
web_development/project_1, thus denying access for testers to see the currently-in-deveopment source. When it is ready for testing/QA, they would copy it to the staging subdirectory.
/etc/ssh/sshd_configwe have the line:
Subsystem sftp /usr/libexec/openssh/sftp-server. We have OpenSSH version 5.3p1-94 installed.