usenix conference policies
Priv: Secure and Flexible Privileged Access Dissemination
Brian C. Hill, University of California, Davis
Large UNIX installations have become increasingly demanding of ever growing staffs of system administrators. Since very few system management tasks can be performed without access to root, large sites quickly face a ``too many cooks'' problem. The problem emerges clearly out of the numerous existing, yet only partial solutions to the problem. Examples of broad access needs are numerous: Help desk staff need to be able to examine user's files to assist over the phone or change passwords. The ability to su(1) to only non-root users is also be useful. System operators need to manage print queues, kill jobs and reboot systems. Neither group, however, should necessarily need access to to pids or files owned by root, making blanket access to kill(1) and cat(1), for example, potentially problematic. Users in a research lab need to mount cdroms. In walk-in consulting areas, securing access to commands via the privileged user's own passwd prevents unattended terminals from being sabotaged. In our environment at UC Davis, we have all of these groups of users and none represent core system administration staff, the only true root users. Several packages and other mechanisms address this issue, but even most of the more expensive commercial packages fail to allow privileged system access that is both secure and flexible.
author = {Brian C. Hill},
title = {Priv: Secure and Flexible Privileged Access Dissemination},
booktitle = {USENIX 10th Systems Administration Conference (LISA 96)},
year = {1996},
address = {Chicago, IL},
url = {https://www.usenix.org/conference/lisa-96/priv-secure-and-flexible-privileged-access-dissemination},
publisher = {USENIX Association},
month = sep
}
connect with us