Ask HN: security vs. utility: admin priviledges
4 comments
I'm an undergrad at the University of Waterloo.
The way most undergrads have dealt with this problem is to buy and bring their own device. It's gotten to the point where we exhausted our IPv4 allocation on our eduroam (Wi-Fi) network, so a year or two back they switched eduroam to mass NAT. (It appears that they're only just starting to add IPv6 support in, but I digress.)
Frankly, any sysadmin worth their salt knows that admin/root access can easily be granted in a secure network, either by using Group Policy (Windows/AD) or by using virtualization (for client-server computing; think KVM/libvirt) or access control (SELinux).
Edit: Need proof? Try http://www.coker.com.au/selinux/play.html
That said-- if you're installing new software and programming languages, you probably shouldn't need or want root, especially if you're using Linux. The binary packages are almost always too stale for what you're doing -- and if you're building from source, you can set PREFIX to $HOME (so you get $HOME/bin, $HOME/man, etc.).
For Ruby and Python in particular, rbenv and virtualenv make it a breeze to use the language (and all the packages/gems you could want) without ever needing to touch root.
The disadvantage of this is that now you have ten post-docs each with a copy of Go and the GHC and Python and Ruby (and sources!) sitting in their homedir, which means that you're now storing thirty gigabytes of source when you could have a few megabytes of binaries. (Think about how this scales when you have 1,000 undergrads on NFS homedirs.)
But that's a trade-off that is up to your department's sysadmins to make.
The way most undergrads have dealt with this problem is to buy and bring their own device. It's gotten to the point where we exhausted our IPv4 allocation on our eduroam (Wi-Fi) network, so a year or two back they switched eduroam to mass NAT. (It appears that they're only just starting to add IPv6 support in, but I digress.)
Frankly, any sysadmin worth their salt knows that admin/root access can easily be granted in a secure network, either by using Group Policy (Windows/AD) or by using virtualization (for client-server computing; think KVM/libvirt) or access control (SELinux).
Edit: Need proof? Try http://www.coker.com.au/selinux/play.html
That said-- if you're installing new software and programming languages, you probably shouldn't need or want root, especially if you're using Linux. The binary packages are almost always too stale for what you're doing -- and if you're building from source, you can set PREFIX to $HOME (so you get $HOME/bin, $HOME/man, etc.).
For Ruby and Python in particular, rbenv and virtualenv make it a breeze to use the language (and all the packages/gems you could want) without ever needing to touch root.
The disadvantage of this is that now you have ten post-docs each with a copy of Go and the GHC and Python and Ruby (and sources!) sitting in their homedir, which means that you're now storing thirty gigabytes of source when you could have a few megabytes of binaries. (Think about how this scales when you have 1,000 undergrads on NFS homedirs.)
But that's a trade-off that is up to your department's sysadmins to make.
I agree with what you said, just wanted to add an aside about privileges:
You can set up a situation where a team has shared access to a particular folder, and install the necessary programming tools there.
ie, set PREFIX to /projects/MYPROJECT or similar, and then grant access to that directory to everyone on the project team.
You can set up a situation where a team has shared access to a particular folder, and install the necessary programming tools there.
ie, set PREFIX to /projects/MYPROJECT or similar, and then grant access to that directory to everyone on the project team.
It's futile to try to learn computing without root access. Buy separate computers to hack on, and just use the departmental computers for non-technical stuff.
I'd probably just go with a Bring-Your-Own-Device strategy.
This is what virtual machines excel at
For example, my postdocs can't install any software without clearing it with the admins in advance (and for experimenting with new software and programming languages, this is really impossible, just think of dependencies).
Another example: I would like to send a student to a python boot camp, but he would need admin privileges on the department laptop. It's a no-go.
My question is: What is the modern "right way" to securely administer a network without laming it to this extent? What is your opinion on what strategy the department should employ?