Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm the sysadmin for a medium sized business, we run our own mail server on premises (linux). Of course, I have sudo privileges on that box, and the email server stores emails in mbox format so in principle I am able to access everybody's mailbox and read emails at will.
I strictly follow the System Administrators' Code of Ethics and I never abused my powers (except when specifically ordered by management to make a copy of someone's inbox, before firing the poor lad).

Now, I'm the one getting laid off, and my manager asked me to lock myself out to prevent to be able to read (presumably their) emails; please note that this is still a "friendly" separation and that I'm going to be employed for few months still (to hand over to a new sysadmin, to be hired). I replied that I can't do my job (administering the server) without root access, and she has just to trust me on this.

Is there a way I can lock myself out while retaining full access?

share|improve this question
3  
They could encrypt their emails or use off site email addresses for sensitive messages. –  jftuga Feb 2 '12 at 20:51
1  
Or personal certs where necessary for exchange email. –  mdpc Feb 2 '12 at 20:56

1 Answer 1

up vote 6 down vote accepted

Short answer probably not.

You might try fashion some written agreement between you and management for the interrum however...your pledge to do no wrong if you will.

Afterall, how effective are contract system administrators (which many companies are going to) without full root access.

share|improve this answer
5  
+1 If you cannot trust your sysadmin, then they really should have no access at all. –  Zoredache Feb 2 '12 at 20:51
1  
What @Zoredache said. Beyond encrypting their truly sensitive messages they need to still have total implicit trust in you if you are going to continue to do your job. If they don't have that level of trust they should terminate your employment immediately, and have your replacement ensure that you are locked out. –  voretaq7 Feb 2 '12 at 23:03
    
Exactly my point, but they can't for obvious reasons (there is no replacement yet, for once). I need to get involved in the selection process of my substitute too, I won't hand over the whole system to a complete idiot (unless they force me to, and against my professional advice). –  ams0 Feb 2 '12 at 23:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.