I think it would be interesting to have a list of bad habits you observe related to system administration. For example:

  • Always using root on servers
  • Sharing account passwords
  • Inserting passwords on code
  • Still using telnet
  • ...

Although I'm mostly interested on security, you bad habit doesn't have to be security related. Bad habits stories are also welcomed.

  • 4
    Still using telnet? Really? – Coops Apr 26 '10 at 16:48
  • 2
    Want to see some non-crypto-enabled Cisco device? :-/ – Massimo Apr 26 '10 at 17:23
  • 2
    I enabled telnet on a server on Friday...For about an hour. Running across a tunnel. If you work with enough legacy crap, you still need it, every now and again. – Satanicpuppy Apr 26 '10 at 20:15
  • 1
    What's worse is... you don't need legacy crap at all. Just buy (recent!) Cisco VOIP appliances, and listen to Cisco consultants proudly saying "we don't support crypto features on these routers' IOS because it's not needed and would slow things down". Because, yes, according to Cisco, SSH console access and full IPSEC support are exactly the same thing. And you need a full crypto-enabled IOS to use SSH instead of Telnet. – Massimo Apr 26 '10 at 20:34
  • @Coops See it for yourself shodanhq.com/?q=port%3A23 – chmeee Apr 27 '10 at 13:41

14 Answers 14


I think most of the bad behaviours of sysadmins is due to the fact that they forget the golden rule:

A sysadmin is there to support the users, not the other way around.

I have beaten this lesson into plenty of new recruits by now, but many new in the field doesn't quite understand how important it is. From this simple rule comes the philosphy when working as a sysadmin:

  • Never, ever, do a risky change on a production system outside maintanance windows
  • If it's new and shiny it's not going into production.
  • If it's old and broken it's not going into production.
  • If it's not documented you don't get paid for it.
  • Changes that shifts work load to the users are not worth it.
  • It's your responsibility to keep it running, no matter what the user is doing.

And from here you can trace the typical bad behaviours of unskilled sysadmins

  • Patching live production systems...
  • Latest stuff pushed into production without carefull testing
  • Using scavenged equipment in production
  • Spotty, limited or (even worse!) wrong documentation
  • "Just copy the addressbook by hand when we switch mail-server!"
  • "It's your fault for not backing it up..."

I think XKCD summed it up pretty well

| improve this answer | |
  • +1 for an awesome relevant xkcd – Joshua Enfield Apr 26 '10 at 18:56
  • 8
    Actually, the golden rule is that the sysadmin is there to support the company. Usually this means supporting the users, but it also occasionally encouraging users to stop less productive behaviors. – David Mackintosh Apr 27 '10 at 3:19
  • @David I would like to agree with you, but the company is often ill-defined and ends up being middle management. And a sysadmin often has to take a fight with middle management to do what is better for everybody. So I prefer the phrasing that they are there to support the users. Obviously supporting users can mean showing them a better way to do stuff... ;) – pehrs Apr 27 '10 at 7:14

Is it a bad habit to give in to user requests (demands?) that lower security for the sake of their own convenience?

  • 3
    It is... and a very common one, if you ask me. – chmeee Apr 26 '10 at 16:52
  • 1
    That's why you need to have a security policy. Get all that discussion and management chain understanding done up front. Then if it gets overruled, you at least get it in writing. – mpez0 Apr 26 '10 at 20:07
  • 1
    In most environments, security must be balanced with convenience. It's a mistake to always treat users like they're trying to break your systems...They do have legitimate needs. – Satanicpuppy Apr 26 '10 at 20:17
  • 2
    yeah, damn users. They'll be wanting the network cable plugged back in next ... don't they understand how to truly secure a server!?!!!? – gbjbaanb Apr 26 '10 at 23:21
  • 2
    I work in a school district. You wouldn't believe the software that crosses our path and the requests to "make it work", and often it does involve breaking permissions or other workarounds. Teenagers mistreat the equipment in many strange and mysterious ways. – Bart Silverstrim Apr 27 '10 at 2:28

Writing a script that isn't well documented or written in an easy to read style so that the people that come after you can easily read and modify the script.

Perl scripters I'm looking at YOU!

| improve this answer | |
  • We have our share of those around here. I keep trying to get everyone to switch to Python. At least then you get a consistent style and don't have to hunt down as many modules to do anything. – 3dinfluence Apr 26 '10 at 17:34
  • I overheard a developer say "it was difficult to write, so it SHOULD be difficult to maintain!" Needless to say, he was soon writing difficult to maintain code elsewhere! – BillN Apr 26 '10 at 20:30
  • 3
    Poor coders can code poorly in any language. – toppledwagon Apr 26 '10 at 22:03

"I'll document this later" No, you won't.

Of course, some preempt that situation thusly: "Documentation?"

| improve this answer | |

I have a bad habit of getting frustrated enough at the security "fixes" in Windows that I'll blindly add sites to a trusted site list or lower security enough that IE8/XP/Vista/etc. stops pestering me while I'm trying to get something done and I'm fairly sure I'm going to the right place and downloading the right file. I know it's supposed to make you more secure to rethink your actions, but quite frankly, click click click click makes me nuts nuts nuts and eventually the warnings all blur together until I don't pay attention to site certificate errors (it's our own self-signed, right?...well, probably...) and other times it's asking me stupid things that should have been enabled by default (yes, I really did mean to go to Windows Update, and I do want security settings to allow Microsoft's own update site to run, thank you...)

  • 2
    +1, Your run on sentence is exactly how that feels :-) – Kyle Brandt Apr 26 '10 at 17:06
  • I usually just install firefox. – reconbot Apr 26 '10 at 17:54
  • Firefox is nice, often use it, but it won't run Windows Updates on those occasions where the WSUS server isn't giving feedback on what the @#$ it's doing in the background, or it acts like it has all the updates installed and I try the manual WinUpdates from IE and HEY ANOTHER ROUND OF UPDATES! And my favorite, it finds updates from the WSUS server as it is downloading them from Windows Updates! Whoever designed that system is allergic to the idea of giving the user feedback or, when necessary, manual control...@#%#@!! – Bart Silverstrim Apr 28 '10 at 0:57

A no-update policy because "it works, so why should we touch it?".

And then Slammer slams you in the head...

| improve this answer | |
  • 4
    This is my favorite. "An update broke something once, so now we're afraid." Really? – Kara Marfia Apr 26 '10 at 17:46
  • I have to fight against this mentality where I'm at as well. – 3dinfluence Apr 26 '10 at 19:03
  • Or the converse: We'll apply every patch there is, whether it's required or not. Then end up with more vulnerabilities and instability as a result of those patches. – John Gardeniers Apr 26 '10 at 21:47

Applying vendor updates the instant they become available. Wait a few hours and google the patch's name to avoid being the one submitting the horror stories.

| improve this answer | |
  • That's AV definitions. Can't agree with you on this. They are by their installed without manual approval, and are time-critical. The saddest thing to come from the recent McAfee gaf is that a number of organisations will probably undertake absurd measures like pre-testing every AV definition update they push out. Knee-jerk madness. – Chris Thorpe Apr 26 '10 at 23:48
  • I linked to a convenient example but I'm referring to any changes to production machines that are untested. It's unfortunate that an anti-virus vendor caused a problem this time but it's not the first time this has happened. If you have a proper test facility it's a simple matter to make sure the change gets applied there first and a simple smoke test is run. It's a small price to pay to honor your SLAs. – Chris Nava Apr 27 '10 at 1:24
  • It's also a simple matter to delay the install by just a few hours so that you can hit the kill switch if the interwebs report problems. – Chris Nava Apr 27 '10 at 1:25

Saying "WHAT!?" whenever a user nears your desk.

| improve this answer | |
  • 2
    See i prefer to just start playing with my knife ... most of em get the idea :-D – Zypher Apr 26 '10 at 16:50
  • 1
    Zypher: The irony was I was just playing with my knife :-) (Was just opening some boxes a little while ago and had it on my desk) – Kyle Brandt Apr 26 '10 at 17:02
  • 2
    Rolling your eyes and heaving a massive sigh works well also. – squillman Apr 26 '10 at 17:29
  • 1
    I think the bad habbit is not wanting to help your users. I notice I get like this sometimes, and I have to remind myself that it's my job and I shouldn't begrudge that. – reconbot Apr 26 '10 at 17:54
  • 1
    I don't mind helping users. It is just talking to them that gets annoying. Some days I wish I could make 'How To Ask Questions The Smart Way' mandatory reading. – Zoredache Apr 26 '10 at 18:55

Using the same password on multiple systems or applications (a la Apache Foundation).

| improve this answer | |
  • I've always been concerned with this, I operating probably 70+ Linux servers, all which i have my user account, but is there an actual alternative to attempting to memorize a retarded amount of passwords? – grufftech Apr 27 '10 at 22:24
  • Use certs to authenticate with SSH, but yeah, it's a pain. I use passphrases that I can easily remember for the servers I login to often, and use KeyPass for the ones I don't and therefore won't remember. – gravyface Apr 28 '10 at 1:30

Meaningless work log entries. ie:

$ rm *

Great, you deleted something, somewhere, as some user, on some system. I have the same alert, and I'd like to know how you fixed it last time.

Here is a prompt which solves most of those issues automatically.

PS1="\h \d \t \w\n\u > "

myserver Mon Apr 26 16:20:44 /var/log
root >

Hostname changed :-) Now I know everything except what you deleted, but at least I know where to look.

| improve this answer | |

regarding the comment

Writing a script that isn't well documented or written in an easy to read style so that the people that come after you can easily read and modify the script. Perl scripters I'm looking at YOU!

spaghetti code gets written in all programming languages (so also in Python, Ruby or whatever). Do not blame the langauge, blame the coder.

A couple of funny comments by a python programmer abouth the current state of Python code being written out there. This guy earns his living debugging crappy Python code written by somebody else:



Moral of the story: when Perl was the only interpreted language in town, everybody was writing Perl, and many people who were not programmers were writing crappy Perl. Now more and more people are picking up Python, so more and more crappy Python programs are being written. Or Powershell, or ..., or ...

So please stop spreading FUD about Perl, it's not the language, it's the coder.

| improve this answer | |

Perhaps not a true habit but how about habitually expecting senior managers to have and/or use a brain? Or believing programmers have a basic understanding of the machine and OS they're programming for?

| improve this answer | |

Spending times on forums or - worse! :) - Q&A sites when you should be working.


Logging in from Internet cafes to do work on the road without using one-time passwords.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.