On 07/08/2014 11:31 PM, Dirk Gently wrote:
Anton Aylward wrote:
On 07/07/2014 04:00 PM, Dirk Gently wrote:
A lot of organizations using Linux or Unix would come to a screeching halt if the default permissions for home directories were drwx------.
Please explain why. Please explain what business decisions lead to and justify that and why they exclude other approaches.
I ask this because I have run both development and operational sites where the user's individual home directories were so protected.
Well, then, you've never worked at the organizations I've been in.
:-) No, just many banks and other places that need 'Chinese wall' security for legal and business reasons.
If your justification is the need to share, then there are other, cleaner, better managed ways to do it, such as setting up project directories or using web based interfaces.
Or a user can put all of his personal stuff in a personal directory that he keeps locked down.
MUCH simpler.
No, not simpler because it makes many assumptions about users being savvy enough and disciplined enough to do all that. I have enough battles dealing with developers who demand production data for testing, try to release inadequately tested apps to production and more. Given that these people who *KNOW* UNIX can't be relied on to follow basic security practices, how can wee expect the Joe Sixpack users to? It is clear that you don't understand the difference between 'discretionary", that is end-user managed, access control, and policy-driven and enforced 'mandatory' access control. Users should need to know this kind of thing, shouldn't have to deal with it. Setting things up so that it is so is the responsibility of the admin. Defining the need to have this basic mandatory security, so as to comply with a host of both regulations and good practices, is management's responsibility. Letting admins make decisions about this according to their personal judgement means that management is failing in its (possibly fudicial) duty. Early in my career I did work at the kind of comapnines you describe and hated it ebcuase the lack of policy and enforcement mean that I was forever 'fighting fires', cleaning up messes that arose from the lack of policy and enforcement and getting in 'Sez You' arguments over good practice. That may be fine in 'the frontier' or as Steve McConnel puts it, during Gold Rush days[1]
If 18-year old freshmen can handle it, then surely adults in the workplace can figure it out.
Experience tells me otherwise.
Of course many system implement some kind of RBAC (even if only in overlay).
It is a matter of how seriously your organization takes security. There is increasing pressure in this area.
There's security, and then there's setting up pointless walls which the employees will just bypass, destroying all of your grand security ideas.
While true you are adopting a 'throw the baby out with the bathwater' attitude. Security can also focus on what needs to be done, eliminate distractions, remove 'cart-before-the-horse' scenarios, garner budget, coordinate activities of various groups, achieve economies of scale, assure consistency, and from a management perspective it has a number of advantages related to legal and regulatory matters. I realise that a highly focused 'heads-down' sysadmin won't see any of these aspects, but business does need to deal with this. From a business POV its as essential bas a disaster recovery plan.
When you cross a domain, you're going outside of not only the tightly knit group, you're typically going across organizational lines, too (like Engineering and Accounting).
That may be true in some circumstances but there are many situations where the 'domains' exist as silos withing the same group. Brokers at a brokerage need to have 'Chinese walls' that limit what can be communicated between different brokers. One of the advantages of RBAC is the way you can define a hierarchy -- something that is very difficult to do with the basic UNIX groups mechanism.
Not every organization is the Department of Defense.
True. There are banks, there are brokerages, there are companies like Ford and GM that have 'trade secrets' and need to protect against stock manipulation. Heck, its very clear that the basic infrastructure of the internet, the routers and DNS servers, and key services like Google need a level of security which exceeds that demonstrated by the DoD/MoD. And that's before we get into issues of civilian infrastructure. All of which makes it very clear -- look to the evidence -- that end users and the mass of sysadmins in the US government agencies are not implementing basic security measures. By many scales, commercial organizations seem better at computer security than the DoD. [1] http://www.amazon.com/After-Gold-Rush-Profession-Engineering/dp/0735608776 http://www.stevemcconnell.com/psd/12-softwaregoldrushes.htm -- /"\ \ / ASCII Ribbon Campaign X Against HTML Mail / \ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org