The trick on the login server is to have the ssh wrapper utility that will allow them SSH access and also log their SSH activity. The app I wrote: - setup one user that the app will use where the SSH keys are store and secure the home directory - has 2 set of keys - admin in normal SSH keys - users that can access with admin SSH keys are added to the configuration, their UID is checked and compared between the confiuration and system UID for their user - app then calls a the app via a "connect" - this calls the "script" binary to log the output of the SSH session
Consists of 2 scripts: First script is the "connect" script - it will check if the user is permitted to use it (using the configuration file) the it calls, via sudo -u sshkeyuser script [options] ssh root@server . The logs are stored in /var/log/ssh-session/ where you can see all that it has been done in the users shell when he had it open.
And lastly - a strong NDA and contract to protect your IP and prevent them on bragging around on the "XY" feature they're working on.
When they are working in your office, in the room next to yours, are they prevented from putting in a USB drive and copying files that way?