2

I'm the sysadmin for a medium sized business, we run our own mail server on premises (linux). Of course, I have sudo privileges on that box, and the email server stores emails in mbox format so in principle I am able to access everybody's mailbox and read emails at will.
I strictly follow the System Administrators' Code of Ethics and I never abused my powers (except when specifically ordered by management to make a copy of someone's inbox, before firing the poor lad).

Now, I'm the one getting laid off, and my manager asked me to lock myself out to prevent to be able to read (presumably their) emails; please note that this is still a "friendly" separation and that I'm going to be employed for few months still (to hand over to a new sysadmin, to be hired). I replied that I can't do my job (administering the server) without root access, and she has just to trust me on this.

Is there a way I can lock myself out while retaining full access?

2
  • 3
    They could encrypt their emails or use off site email addresses for sensitive messages.
    – jftuga
    Feb 2, 2012 at 20:51
  • 1
    Or personal certs where necessary for exchange email.
    – mdpc
    Feb 2, 2012 at 20:56

1 Answer 1

6

Short answer probably not.

You might try fashion some written agreement between you and management for the interrum however...your pledge to do no wrong if you will.

Afterall, how effective are contract system administrators (which many companies are going to) without full root access.

3
  • 5
    +1 If you cannot trust your sysadmin, then they really should have no access at all.
    – Zoredache
    Feb 2, 2012 at 20:51
  • 1
    What @Zoredache said. Beyond encrypting their truly sensitive messages they need to still have total implicit trust in you if you are going to continue to do your job. If they don't have that level of trust they should terminate your employment immediately, and have your replacement ensure that you are locked out.
    – voretaq7
    Feb 2, 2012 at 23:03
  • Exactly my point, but they can't for obvious reasons (there is no replacement yet, for once). I need to get involved in the selection process of my substitute too, I won't hand over the whole system to a complete idiot (unless they force me to, and against my professional advice). Feb 2, 2012 at 23:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .