Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Where I work, we have very light security policy which allows users to connect to their personal mail accounts and so on.

Every user is root on his own computer and there is no centralized account management. It's pretty much like all computers where standalone/personal computers on the same local area network.

The only exception is that the sys-admins demand that we put a key in our /root/.ssh/authorized_keys so they can backup our files. Fair enough, except that I'm a bit paranoid.

I have nothing against having mandatory backups (I even agree it is a good thing) but on some occasion, I plug my personal ciphered usb key that contains my personal password database (keepass) and I'd like to avoid that its content gets backuped.

So here is my question:

Is there a way for me to automatically unmount the USB key volume or even better: to delay the root login from an external host until my usb key is unmounted/plugged ?

What would be the easiest/safest way to do that ?

Note: My employer actually agrees with this setup.

Note #2: Reading the comments, I would say I now understand what is wrong in asking that, and how it could seem I'm trying to piss my sysadmin. I can't blame anyone for not trusting me of course, and I sincerely want to apologize if at any point I made it sound like I was "smarter than the sysadmin" or anything. This question expected a purely technical answer but a purely technical answer would not have been a good answer. As they say: "Science without conscience is but the ruin of the soul..." Thanks to you all for your feedback.

share|improve this question

closed as off topic by MDMarra, Wesley, Dave M, mdpc, Magellan Oct 10 '12 at 16:23

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

The core question is who owns the computer? If the computer is owned by your employer you may not be standing on very firm ground to limit IT's access. Also consider this, backups are for your protection, if you put something in place to prevent centralized backups and something goes wrong, oh well right? Not quote so if you also lost many hours of deliverables (work). – Red Tux Oct 10 '12 at 16:01
Ok, ignoring the fact that this type of setup is absolutely insane, this question is off-topic and doesn't exactly fit within the scope of this site as outlined in our faq. – MDMarra Oct 10 '12 at 16:01
@MDMarra: I read the FAQ but I admit I fail to see where I violate the conditions of acceptance. Does my question really fall to the "system misuse case" when my employer explicitely gives his permission for this setup ? – ereOn Oct 10 '12 at 16:08
This site is also not for end user questions, so regardless of the whys and wherefores the question remains off topic. – John Gardeniers Oct 10 '12 at 16:47
The answer to your question is simple: Contact your system administrator, and request that USB media be exempted from the backup of your workstation. If your company is truly OK with you having personal devices connected to your workstation they should not mind ignoring them during backups (in fact for space and liability reasons they probably don't want to back up your data...) – voretaq7 Oct 10 '12 at 20:45
up vote 8 down vote accepted

The best way to keep your employer from your "personal" data is to keep your personal data off your employer's computer. Period.

share|improve this answer
+1 Works perfectly every time! – Dave M Oct 10 '12 at 16:06
That sure is the best way. My employer allows me to connect to my personal accounts using a company computer and even agrees not to backup my password database. I'm actually asking how to do it, not if I'm allowed to. I can understand how this can seem insane to sysadmins. Fair enough. But can't I take advantage of the extra permissions I was given by my employer ? – ereOn Oct 10 '12 at 16:09
@ereOn - walk into a police station and ask them for safe-cracking tips - see how you get on ;) – Chopper3 Oct 10 '12 at 16:13
If your employer has given you permission to do this, then ask your company's sysadmins to help you. If they have trouble, send them here :-) – mfinni Oct 10 '12 at 16:17
ereOn - it's not a matter of honesty. Think of it this way - your sysadmin, the one who is paid to fix your problems, doesn't want to spend any time on this issue because it's not work-related. We do the same job as that guy, and we're not paid for the answers we give on this site. Until you explained that this was cool with your employer, this sounded like an attempted subversion of policy. Thus, no good answers from us for that. – mfinni Oct 10 '12 at 16:20

The best way is to mount the key in a place in the filesystem that isn't already backed up. I assume they're not backing up /, /tmp, etc. Find out what they are backing up, and then mount the drive elsewhere.

share|improve this answer
Mounting it in /tmp is a very good idea. Thanks. I accepted the first answer for ethical reasons which I explained in the question, but upvoted this one for fairness. – ereOn Oct 10 '12 at 16:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.