TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Ask HN: security vs. utility: admin priviledges

1 pointsby mgualtalmost 12 years ago
I work at a university, and the computer services for my academic department are managed in-house by a couple of computer officers. To maintain a secure network, they do not allow users admin privileges on any machine for which they provide support. While I understand this point of view, (and I am aware that there are probably many potential problems that I have no knowledge of) it seems to render the network much less useful than it could otherwise be.<p>For example, my postdocs can&#x27;t install any software without clearing it with the admins in advance (and for experimenting with new software and programming languages, this is really impossible, just think of dependencies).<p>Another example: I would like to send a student to a python boot camp, but he would need admin privileges on the department laptop. It&#x27;s a no-go.<p>My question is: What is the modern &quot;right way&quot; to securely administer a network without laming it to this extent? What is your opinion on what strategy the department should employ?

4 comments

cbhlalmost 12 years ago
I&#x27;m an undergrad at the University of Waterloo.<p>The way most undergrads have dealt with this problem is to buy and bring their own device. It&#x27;s gotten to the point where we exhausted our IPv4 allocation on our eduroam (Wi-Fi) network, so a year or two back they switched eduroam to mass NAT. (It appears that they&#x27;re only just starting to add IPv6 support in, but I digress.)<p>Frankly, any sysadmin worth their salt knows that admin&#x2F;root access can easily be granted in a secure network, either by using Group Policy (Windows&#x2F;AD) or by using virtualization (for client-server computing; think KVM&#x2F;libvirt) or access control (SELinux).<p>Edit: Need proof? Try <a href="http://www.coker.com.au/selinux/play.html" rel="nofollow">http:&#x2F;&#x2F;www.coker.com.au&#x2F;selinux&#x2F;play.html</a><p>That said-- if you&#x27;re installing new software and programming languages, you probably shouldn&#x27;t need or want root, especially if you&#x27;re using Linux. The binary packages are almost always too stale for what you&#x27;re doing -- and if you&#x27;re building from source, you can set PREFIX to $HOME (so you get $HOME&#x2F;bin, $HOME&#x2F;man, etc.).<p>For Ruby and Python in particular, rbenv and virtualenv make it a breeze to use the language (and all the packages&#x2F;gems you could want) without ever needing to touch root.<p>The disadvantage of this is that now you have ten post-docs each with a copy of Go and the GHC and Python and Ruby (and sources!) sitting in their homedir, which means that you&#x27;re now storing thirty gigabytes of source when you could have a few megabytes of binaries. (Think about how this scales when you have 1,000 undergrads on NFS homedirs.)<p>But that&#x27;s a trade-off that is up to your department&#x27;s sysadmins to make.
评论 #6118567 未加载
tlbalmost 12 years ago
It&#x27;s futile to try to learn computing without root access. Buy separate computers to hack on, and just use the departmental computers for non-technical stuff.
_cbdevalmost 12 years ago
I&#x27;d probably just go with a Bring-Your-Own-Device strategy.
stephenralmost 12 years ago
This is what virtual machines excel at