15

I think it would be interesting to have a list of bad habits you observe related to system administration. For example:

  • Always using root on servers
  • Sharing account passwords
  • Inserting passwords on code
  • Still using telnet
  • ...

Although I'm mostly interested on security, you bad habit doesn't have to be security related. Bad habits stories are also welcomed.

5
  • 4
    Still using telnet? Really?
    – Coops
    Apr 26, 2010 at 16:48
  • 2
    Want to see some non-crypto-enabled Cisco device? :-/
    – Massimo
    Apr 26, 2010 at 17:23
  • 2
    I enabled telnet on a server on Friday...For about an hour. Running across a tunnel. If you work with enough legacy crap, you still need it, every now and again. Apr 26, 2010 at 20:15
  • 1
    What's worse is... you don't need legacy crap at all. Just buy (recent!) Cisco VOIP appliances, and listen to Cisco consultants proudly saying "we don't support crypto features on these routers' IOS because it's not needed and would slow things down". Because, yes, according to Cisco, SSH console access and full IPSEC support are exactly the same thing. And you need a full crypto-enabled IOS to use SSH instead of Telnet.
    – Massimo
    Apr 26, 2010 at 20:34
  • @Coops See it for yourself shodanhq.com/?q=port%3A23
    – chmeee
    Apr 27, 2010 at 13:41

14 Answers 14

22

I think most of the bad behaviours of sysadmins is due to the fact that they forget the golden rule:

A sysadmin is there to support the users, not the other way around.

I have beaten this lesson into plenty of new recruits by now, but many new in the field doesn't quite understand how important it is. From this simple rule comes the philosphy when working as a sysadmin:

  • Never, ever, do a risky change on a production system outside maintanance windows
  • If it's new and shiny it's not going into production.
  • If it's old and broken it's not going into production.
  • If it's not documented you don't get paid for it.
  • Changes that shifts work load to the users are not worth it.
  • It's your responsibility to keep it running, no matter what the user is doing.

And from here you can trace the typical bad behaviours of unskilled sysadmins

  • Patching live production systems...
  • Latest stuff pushed into production without carefull testing
  • Using scavenged equipment in production
  • Spotty, limited or (even worse!) wrong documentation
  • "Just copy the addressbook by hand when we switch mail-server!"
  • "It's your fault for not backing it up..."

I think XKCD summed it up pretty well

3
  • +1 for an awesome relevant xkcd Apr 26, 2010 at 18:56
  • 8
    Actually, the golden rule is that the sysadmin is there to support the company. Usually this means supporting the users, but it also occasionally encouraging users to stop less productive behaviors. Apr 27, 2010 at 3:19
  • @David I would like to agree with you, but the company is often ill-defined and ends up being middle management. And a sysadmin often has to take a fight with middle management to do what is better for everybody. So I prefer the phrasing that they are there to support the users. Obviously supporting users can mean showing them a better way to do stuff... ;)
    – pehrs
    Apr 27, 2010 at 7:14
12

Is it a bad habit to give in to user requests (demands?) that lower security for the sake of their own convenience?

6
  • 3
    It is... and a very common one, if you ask me.
    – chmeee
    Apr 26, 2010 at 16:52
  • 1
    That's why you need to have a security policy. Get all that discussion and management chain understanding done up front. Then if it gets overruled, you at least get it in writing.
    – mpez0
    Apr 26, 2010 at 20:07
  • 1
    In most environments, security must be balanced with convenience. It's a mistake to always treat users like they're trying to break your systems...They do have legitimate needs. Apr 26, 2010 at 20:17
  • 2
    yeah, damn users. They'll be wanting the network cable plugged back in next ... don't they understand how to truly secure a server!?!!!?
    – gbjbaanb
    Apr 26, 2010 at 23:21
  • 2
    I work in a school district. You wouldn't believe the software that crosses our path and the requests to "make it work", and often it does involve breaking permissions or other workarounds. Teenagers mistreat the equipment in many strange and mysterious ways. Apr 27, 2010 at 2:28
10

Writing a script that isn't well documented or written in an easy to read style so that the people that come after you can easily read and modify the script.

Perl scripters I'm looking at YOU!

3
  • We have our share of those around here. I keep trying to get everyone to switch to Python. At least then you get a consistent style and don't have to hunt down as many modules to do anything. Apr 26, 2010 at 17:34
  • I overheard a developer say "it was difficult to write, so it SHOULD be difficult to maintain!" Needless to say, he was soon writing difficult to maintain code elsewhere!
    – BillN
    Apr 26, 2010 at 20:30
  • 3
    Poor coders can code poorly in any language. Apr 26, 2010 at 22:03
9

"I'll document this later" No, you won't.

Of course, some preempt that situation thusly: "Documentation?"

6

I have a bad habit of getting frustrated enough at the security "fixes" in Windows that I'll blindly add sites to a trusted site list or lower security enough that IE8/XP/Vista/etc. stops pestering me while I'm trying to get something done and I'm fairly sure I'm going to the right place and downloading the right file. I know it's supposed to make you more secure to rethink your actions, but quite frankly, click click click click makes me nuts nuts nuts and eventually the warnings all blur together until I don't pay attention to site certificate errors (it's our own self-signed, right?...well, probably...) and other times it's asking me stupid things that should have been enabled by default (yes, I really did mean to go to Windows Update, and I do want security settings to allow Microsoft's own update site to run, thank you...)

3
  • 2
    +1, Your run on sentence is exactly how that feels :-) Apr 26, 2010 at 17:06
  • I usually just install firefox.
    – reconbot
    Apr 26, 2010 at 17:54
  • Firefox is nice, often use it, but it won't run Windows Updates on those occasions where the WSUS server isn't giving feedback on what the @#$ it's doing in the background, or it acts like it has all the updates installed and I try the manual WinUpdates from IE and HEY ANOTHER ROUND OF UPDATES! And my favorite, it finds updates from the WSUS server as it is downloading them from Windows Updates! Whoever designed that system is allergic to the idea of giving the user feedback or, when necessary, manual control...@#%#@!! Apr 28, 2010 at 0:57
6

A no-update policy because "it works, so why should we touch it?".

And then Slammer slams you in the head...

3
  • 4
    This is my favorite. "An update broke something once, so now we're afraid." Really? Apr 26, 2010 at 17:46
  • I have to fight against this mentality where I'm at as well. Apr 26, 2010 at 19:03
  • Or the converse: We'll apply every patch there is, whether it's required or not. Then end up with more vulnerabilities and instability as a result of those patches. Apr 26, 2010 at 21:47
5

Applying vendor updates the instant they become available. Wait a few hours and google the patch's name to avoid being the one submitting the horror stories.

3
  • That's AV definitions. Can't agree with you on this. They are by their installed without manual approval, and are time-critical. The saddest thing to come from the recent McAfee gaf is that a number of organisations will probably undertake absurd measures like pre-testing every AV definition update they push out. Knee-jerk madness. Apr 26, 2010 at 23:48
  • I linked to a convenient example but I'm referring to any changes to production machines that are untested. It's unfortunate that an anti-virus vendor caused a problem this time but it's not the first time this has happened. If you have a proper test facility it's a simple matter to make sure the change gets applied there first and a simple smoke test is run. It's a small price to pay to honor your SLAs.
    – Chris Nava
    Apr 27, 2010 at 1:24
  • It's also a simple matter to delay the install by just a few hours so that you can hit the kill switch if the interwebs report problems.
    – Chris Nava
    Apr 27, 2010 at 1:25
4

Saying "WHAT!?" whenever a user nears your desk.

8
  • 2
    See i prefer to just start playing with my knife ... most of em get the idea :-D
    – Zypher
    Apr 26, 2010 at 16:50
  • 1
    Zypher: The irony was I was just playing with my knife :-) (Was just opening some boxes a little while ago and had it on my desk) Apr 26, 2010 at 17:02
  • 2
    Rolling your eyes and heaving a massive sigh works well also.
    – squillman
    Apr 26, 2010 at 17:29
  • 1
    I think the bad habbit is not wanting to help your users. I notice I get like this sometimes, and I have to remind myself that it's my job and I shouldn't begrudge that.
    – reconbot
    Apr 26, 2010 at 17:54
  • 1
    I don't mind helping users. It is just talking to them that gets annoying. Some days I wish I could make 'How To Ask Questions The Smart Way' mandatory reading.
    – Zoredache
    Apr 26, 2010 at 18:55
3

Using the same password on multiple systems or applications (a la Apache Foundation).

2
  • I've always been concerned with this, I operating probably 70+ Linux servers, all which i have my user account, but is there an actual alternative to attempting to memorize a retarded amount of passwords?
    – grufftech
    Apr 27, 2010 at 22:24
  • Use certs to authenticate with SSH, but yeah, it's a pain. I use passphrases that I can easily remember for the servers I login to often, and use KeyPass for the ones I don't and therefore won't remember.
    – gravyface
    Apr 28, 2010 at 1:30
3

Meaningless work log entries. ie:

$ rm *

Great, you deleted something, somewhere, as some user, on some system. I have the same alert, and I'd like to know how you fixed it last time.

Here is a prompt which solves most of those issues automatically.

PS1="\h \d \t \w\n\u > "

myserver Mon Apr 26 16:20:44 /var/log
root >

Hostname changed :-) Now I know everything except what you deleted, but at least I know where to look.

3

regarding the comment

Writing a script that isn't well documented or written in an easy to read style so that the people that come after you can easily read and modify the script. Perl scripters I'm looking at YOU!

spaghetti code gets written in all programming languages (so also in Python, Ruby or whatever). Do not blame the langauge, blame the coder.

A couple of funny comments by a python programmer abouth the current state of Python code being written out there. This guy earns his living debugging crappy Python code written by somebody else:

http://artificialcode.blogspot.com/2010/04/professionalism-in-python-or-how-to-not.html

http://artificialcode.blogspot.com/2010/04/my-midlife-python-quality-crisis.html

Moral of the story: when Perl was the only interpreted language in town, everybody was writing Perl, and many people who were not programmers were writing crappy Perl. Now more and more people are picking up Python, so more and more crappy Python programs are being written. Or Powershell, or ..., or ...

So please stop spreading FUD about Perl, it's not the language, it's the coder.

3

Perhaps not a true habit but how about habitually expecting senior managers to have and/or use a brain? Or believing programmers have a basic understanding of the machine and OS they're programming for?

1

Spending times on forums or - worse! :) - Q&A sites when you should be working.

1

Logging in from Internet cafes to do work on the road without using one-time passwords.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .