Tag Info

Hot answers tagged

56

Most developers are technically savy and know what they are doing. They often need to install many specialist apps, having to get permission to do this and getting IT to come down and add it can be very frustrating, particularly in larger companies, for both sides. I've found what works best is allowing them to do what they want with regards to installing ...


50

Should they? That's up to the corporation. Personally I think it's fine as long as there are some understood rules. Being admin on your box is a privilege NOT a right. Catching viruses on multiple occasions will get the right revoked Disabling corporate agents will get the right revoked - AV/inventory/software deployment/etc Basically if you do something ...


30

Since the operational responsibility of a production system usually pertains to a Sysadmin, only a Sysadmin should have full administrative access to the system - it's as simple as that. Now, you might say "Well, sometimes we make code changes that require system reconfiguration, shouldn't we have access to reconfigure the systems accordingly?" NO If your ...


29

Typically I would say yes. Things like debuggers require pretty high if not admin rights to work correctly. Developers often need to install random software which can take days or weeks to get installed when going through channels. During that time the developer is usually work stopped costing the company nothing but money, especially if the developer is ...


16

In a Windows environment, and especially when using Microsoft developer products, the dev will require admin rights on their machine. If you deny them those rights their ability to do their jobs will be restricted, if not prevented altogether.


16

There is both science and art in development; it isn't as simple as "knowing" what we need. If we already had the answer half our job would be moot; finding the correct approach is often iterative, and may involve multiple tools in unpredictable ways. Requiring an intermediary to install each of these (often with high latency), only to find (about an hour ...


16

I am not saying sysadmins are perfect, but there are a huge number of examples of developers that shouldn't even be developers. Let alone being permitted to having root access to systems with mission critical data. But in any case it is mostly about taking responsibility for changes made. For many sysadmins it seems that developers will go do things on ...


15

You could use sudo in place of your custom script to accomplish the same thing. That is, given the default supervisord configuration, in which only root can run supervisorctl, you could put an entry like this into /etc/sudoers: alice ALL = (root) NOPASSWD:/usr/bin/supervisorctl restart app1 bob ALL = (root) NOPASSWD:/usr/bin/supervisorctl restart app2 ...


14

See this Stackoverflow posting for some lively debate about the merits of locking down developer machines. (Disclaimer: I wrote the accepted answer). From a sysadmin perspective, access to production systems is sensitive and you should restrict such access to people who need it to do their job (this may include developers who have tier-3 support ...


13

You can assign this in either a GPO or Local Security Policy. The setting that you're looking for is in Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Shutdown the system


12

I'll try to explain with a metaphor (I'm a developer, occasionally doing sysadmin stuff btw.) Painter and Interior decorator Let's say the developer is a painter, and creates a lot of fantastic paintings. Ok, maybe they aren't fantastic but he made what his employer asked him to make. He's good at that so all the paintings turn out fine. Now the paintings ...


11

No. There is no way to prevent an admin from being an admin. You cannot simultaneously have your files encrypted in such a manner so as to keep them safe from the prying eyes of another administrator on the system, and have an application seamlessly decrypt and access those files in a way that an administrator could not also mimic. To suggest otherwise ...


11

The biggest problem with not locking down a developers machine is that any software they develop will require full administrator privileges to run. The developers access should be the same as the environment that they will need to run in. If they need to be "self supportable" or "self installable" then give them another admin account e.g. Bruce.admin which ...


10

You're looking for Delegation of Control in Active Directory (AD) to grant your "IT Helper" access to perform limited administrative operations in AD. This functionality is very flexible, and I'd recommend you do some reading and make up some test scenarios to become familiar. The specific steps for delegating rights to join computers to a domain are ...


10

You're correct, the Power Users group does not do anything at all in Windows Vista and later. From http://technet.microsoft.com/en-us/library/cc771990.aspx: By default, members of this group have no more user rights or permissions than a standard user account. The Power Users group in previous versions of Windows was designed to give users specific ...


9

In being a developer, I rank us a level of privilege above the basic user, but below the systems administrator(s). I may, on occasion, need an extra library installed to get the application I am developing to work in the production environment, that being said, I have a strict rule I develop by: "For any application which requires third-party libraries, the ...


8

The most sensible option I've ever seen (have been on both sides -and still am-) is simply unlocked stuff and unsupported as well. Give them liberty, and if they screw up, all they can get is a restage with a standard image... . In that situation, I find it a good plan to put them on some form of "untrusted" network. As far as the (non)sense of locking ...


8

Yes, adding a new non-root user, then sudoing from it is the "best-practice". If you have a lot of commands to run at once many people say to run sudo su -. However, sudo has a -i option that is used to give you a root shell. Also, if you want to disable interactive logins for root, you can change the password in /etc/shadow to '!'. To have two users ...


8

Short answer - you can't. Long answer - you can monkey with permissions on specific registry keys, folders, etc such that it is more difficult for a local admin to remove the product. If you want to go this way I recommend the uninstall registry keys under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall. Unless someone has the ...


8

I advise turning it around around and putting yourself in the position as the other party. So, in that vein: Why shouldn't sysadmins have full access to modify the source code? The long and short of it, to me, is that developers shouldn't have root access because they don't necessarily know what they're doing from the perspective of systems ...


7

Why are your users browsing somewhere that they can see this in the first place? There are a few things I'd like to address, so bear with me. It appears you're using a domain controller as a file server if your users are seeing NETLOGON and SYSVOL. Don't do this. Have your domain controllers run AD DS, DNS, and nothing else if at all possible. You don't ...


7

Assuming the jumpbox is a linux box, iptables can usefully be used on the OUTPUT chain to restrict which group members can connect to which servers. Something like iptables -A OUTPUT --gid-owner project1 -p tcp --dport 22 -d ip.of.project1.com -j ACCEPT iptables -A OUTPUT --gid-owner project1 -j REJECT iptables -A OUTPUT --gid-owner project2 -p tcp --dport ...


7

Personally, I would set the ownership of /var/www/html to apache. You can do this by: chown apache /var/www/html Next, I would create a group of let's say "Web admins": groupadd webadmins Add the user webadmin to the newly created group: usermod -G webadmins webadmin Add group permissions to the newly created group: chmod g+rw /var/www/html


7

One way is to launch a shell for that user (explicitly specifying the shell): sudo -u www-data bash This will launch a (bash) shell as the specified user. You can then execute your command(s) and logout (to return to your previous shell)


7

Windows Server Update Services (WSUS) provides the server-side component to handle update deployment. Its provided by Microsoft as a no-cost add-on to Windows Server 2003 and up. Computers (client PCs, servers, etc) are typically directed to the WSUS server to receive updates by way of Group Policy settings (that can also be done through simple registry ...


6

You can use the sc command to set permissions on a specific service. The format is a little difficult to understand, but first you will need to find the user or group's SID to use the command (something like "S-1-5-21-...."). sc myserver sdset spooler D:(A;;RPWP;;;place-sid-here) A couple notes on that command: RP Allows service start WP Allows service ...


6

The answer is really: there is no simple yes or no answer. But security is at least as important for your dev users as for anyone else. On the one hand, yes devs tend to be technically more savvy. On the other hand, theirs is often a stressful job and their dev milestones are likely to take priority over the extra care needed to maintain one's own system as ...


6

The inability to "drag and drop" from Explorer to an elevated Notepad window is a manfestation of the user interface privilege isolation (UIPI) feature. It's in the OS to prevent an less-privileged application from sending arbitrary "messages" (in the sense of operating system / application inter-process communication) to another, higher-privileged ...


6

Disclaimer: I'm a developer. To me, this question (and the answers) seem to be attacking the problem from the wrong approach - that is, the debate is focusing on what admins want/need vs. what developers want/need. But you specified we are in a corporate environment, so let's look at it that way. So let's imagine we are arguing this in front of the ...


6

GNU chown uses a colon instead now to separate user and group. chown abc-def:abc-def * -R



Only top voted, non community-wiki answers of a minimum length are eligible