I have an unexpected request that I'd like to hear if anyone else has tried...

I have a site going live next week that wants to disable the host and possibly the admin accounts through SQL to prevent anyone from 'accidentally' screwing something up with the production site.  It's a mission critical site that would cause them much embarrasment if an employee or contractor made a mistake while it was live.

They want to give us VPN access to the web and SQL boxes, and be able to control access that way.  If for some reason the Admin or Host accounts were needed, we would enable them via SQL and disable them as soon as the task was completed.

Has anyone ever tried something like this?

I also don't want the possibility of being blamed for anything, If they need a change I want them to tell me what they want, enable the VPN for me to do it, and disable it when I'm out.  None of this, "Did you sign in to the site as superuser and change 'X'?  We're certain that this was not what was approved, and we're getting complaints about it."  "No, I can't without you allowing me to get into the SQL machine, and that is what you approved." is the right answer there.

The customer has a lot of public visibility, their slightest percieved screw up makes the evening news...  I'd rather not be featured.

I'd write a small commandline app that randomizes the passwords and shows them to the output stream.

You have the server run this app every x hours, so the passwords change regularly. The outputed text disappears into nothingness

when you need access, run the app manually on remote desk and note down the password you need