From: mmt@RedBrick.COM (Maxime Taksar)
Subject: Re: temparary superuser
Organization: Red Brick Systems, Los Gatos, CA
Distribution: usa
Date: Thu, 8 Oct 1992 00:21:14 GMT

In article <1992Oct5.144903.21460@sci34hub.sci.com>, gary@sci34hub.sci.com (Gary Heston) writes:
> In article <1992Oct2.230122.24463@RedBrick.COM> mmt@RedBrick.COM (Maxime Taksar) writes:
> >In article <1992Sep29.164914.13346@sci34hub.sci.com>, gary@sci34hub.sci.com (Gary Heston) writes:
> >[...]
> >> You can learn more by reading the Unix system admin book by Nementh, Seebass,
> >> and Snyder. Do *not* experiment without permission. 
> 
> >I disagree.  Experimentation is often the only way to get a
> >good knowledge of things like Unix.  It can also be the only
> >way to find obscure problems.
> 
> Here, let me quote my statement again:
> 
> >> ....   Do *not* experiment without permission. 
> 
> Note the last two words, there: "without permission". They imply that 
> experimenting *with* permission is OK; so that my statement was not
> a flat prohibition against experimentation in general.

What I'm trying to say is that giving a user an account on a machine,
this is GIVING PERMISSION to expreminent (pay close attention here).
If you leave security holes lying around, you're giving permission
to experiment as root.

No, I actually don't believe in such extremes, but I am trying to
point out the concept of an "attractive nuisance."

> If I (a Unix/NetWare admin) caught a user trying to get root/supervisor
> privledges in the course of "experimenting" on this network, you may rest
> assured their account would be disabled *immediately*, and they would
> probably lose their NIC until after there'd been a discussion of the 
> matter with either our managers or VP. I won't tolerate crackers.

I see.  So you're going to play gestapo with your users?  I
certainly understand the concept that crackers are a Bad Thing,
but why be downright paranoid?  When I see some suspicious
activity (such as numerous "su root" failures in the logs),
I will go and speak with the user and get an explanation.
It's amazing how much "suspicious activity" is caused by an
honest mistake or a buggy script.

I'm not paranoid about someone cracking one of my systems.  Why?
Because I make sure to use good security practices.

> However, if a user approached me and requested permission, or I was told
> by management to provide access for some experimentation, that's an 
> entirely different matter.
> >Computers are tools and not sacred objects.  Users shouldn't be
> >trained to be afraid of them.
> 
> A brick of C4 or a stick of dynamite is a tool as well. I don't want
> anyone experimenting with any of that around me without permission,
> either.

Yes.  They're tools.  However, you don't tend to find
explosives on nearly as many people's desks as computers.
Even so, experimentation and comfort with explosives is
just as necessary as with computers.  What's necessary is
a proper environment where nothing will be damaged because
of it.
 
> The original poster, as I recall, was wanting to get root privledges to
> experiment on a system. Apparently, he didn't bother asking his system
> administrator. That places him in the position of a would-be cracker,
> not just a user in training. I've no objection to training, but lots to
> someone doing rm -r * from / to see how long it'll take. Some experimentation
> *can* cause damage, your experience with your mothers' work system 
> notwithstanding.

The original poster wouldn't be able to get root priveleges
to experiment on the system, assuming he didn't have permission
and the system was properly set up and maintained.

You seem to have a fixation with crackers.  A user in training
*is* a would-be cracker.  An experienced, veteran user is also 
a would-be cracker.

You want to talk about rm -rf /?  I have only one word in response:
Backups.

With proper backups, even the nasty, recursive rm (which
can simulate a complete disk failure) isn't devastating.
 
> To those of you who understand what "without permission" means, my
> apologies for the bandwidth consumption, but it appeared to be necessary.

It's a shame you seem to think that everyone must have an
identical concept of "permission" as you.
-- 
------------------------------------------------------------
Maxime Taksar              KC6ZPS           mmt@RedBrick.COM