Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We hired a new system administrator and this will be the first time delegating this sensitive task to a third person. He's a good guy but we are still wondering about security.

What do you recommend us? Is it wise to give root access of our Linux servers to the new guy? Or should we create a separate user account on Linux? What do you recommend? He will login to our server and monitor/var/log/* files for the beginning.

share|improve this question

closed as primarily opinion-based by Zoredache, Jenny D, Rex, mdpc, EEAA Mar 12 '14 at 5:16

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

You gave me a bit of a double's taking your car to a mechanic and not giving him the keys while working on the car. You hired him to work on your systems. He kinda' needs that access. It's what we do. – Bart Silverstrim Oct 28 '11 at 12:36
If you're more worried about it, hire a second administrator so they keep an eye on each other. Unless they work together to steal things. – Bart Silverstrim Oct 28 '11 at 12:38
LOL :) Okay, thanks for your comments. We should trust and give him full access. – Cem Oct 28 '11 at 12:41
How much are you paying him or her to sit and monitor /var/log files? You could just use a projector with tail -f ... I could set that up for a modest fee... – Bart Silverstrim Oct 28 '11 at 12:57
@BartSilverstrim, the projector comment made me LOL. If they saw something all they could do is shout, "Oh hey, there's a problem!!". – churnd Oct 28 '11 at 14:16
up vote 3 down vote accepted

This isn't to say that all people are completely trustworthy, but sysadmins have by necessity nearly unlimited amount of access so they can do their jobs. If you're worried about security (which you shouldn't be faulted for, seriously...most don't pay attention to it) you may want to work with your sysadmin to install safeguards for auditing.

Have all procedures documented, as should be part of his job. If he were hit by a disgruntled user's car tomorrow you should be able to have a new sysadmin get up to speed fairly quickly with the policy and procedure guides.

Also, your sysadmin shouldn't mind having safeguards in place for protecting his or her actions from fudgey fingers. Sudo logs things. System passwords should be kept safe and accessible if needed, but only to people who actually need it (and it should be known if someone wants to get access to them.)

The sysadmin needs enough freedom to do his job and feel like he or she isn't being second guessed all the time or mistrusted (or why would you have hired him?) Let the sysadmin do the work, but know that he or she can be audited if need be.

It's a red flag if they're too secretive. But it's a problem if management won't let go of the reigns too. And it's worse when people in management keep sticking their fingers into IT if they're not IT people (not saying you're not, since I don't know what you do...but it can be a problem when engineers and/or programmers, who think they know what it's like to do sysadmin tasks, really kinda don't, and insist on doing things their way...)

share|improve this answer
Thanks for all suggestions guys. – Cem Oct 28 '11 at 13:31
Don't feel bad for asking about security; this is something often overlooked and no doubt admins get sensitive about the subject of being mistrusted despite being hired for that very purpose. There's a balance to be struck and it's nice that as part of the management side you're trying to find it. – Bart Silverstrim Oct 28 '11 at 14:05

You give him his own account with sudo access, that way everything he does is logged. You can even somewhat restrict what he can & can't do with sudo. Set up logwatch to email you daily, & all sudo commands will be listed. That'll give you some kinda monitoring. If you stop getting the email or if no sudo commands are listed, you'll know something is up.

Of course, setting up all these things requires at least one other linux savvy person you do trust so if you don't have that, you're just gonna have to trust this guy.

share|improve this answer
This my preference, and indeed what I do with most of my sites - including my own access. Trusting your admins is good. Giving them what they need to do their jobs is good. Audit trails are also good - and not just for the employer. I've been able to point to them in the past to show that it wasn't me that stuffed the prod db volume, or shut down the main web server at 1030h. – MadHatter Oct 28 '11 at 12:55
Well, while I do consider sudo logging a good thing, I don't see how it will protect you from someone whom you don't trust not to be malicious. As a trivial example, any idea what might hide itself behind the following? "sudo emacs /legitimate/config/file". – andol Oct 28 '11 at 14:22

if you hired him.. you must trust him so of course you give him access to everything..

If I wasn't given that, I'd probably walk out within a week because I can't do my job

share|improve this answer
Absolutely - I've never not had the lot on day 1! – Dan Oct 28 '11 at 12:33
You're right Mike. We trust him but he's just so new, that's why I decided to ask for a suggestion. – Cem Oct 28 '11 at 12:34
@Cem if you're worried that he's not qualified, then you hired the wrong guy. If you're satisfied that he is qualified, then you should have nothing to worry about. – MDMarra Oct 28 '11 at 12:44

Ask the new guy what he thinks you should do.

Maybe this should be a standard interview question for system administrators!

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.