6 ms·
> The thing is that that you can't do much against someone who has root access for a living. In banks, significant decisions (like personally authorising multi
by lgieron 10y ago
> The thing is that that you can't do much against someone who has root access for a living.
In banks, significant decisions (like personally authorising multimillion dollar transfer) require two signatures (of two senior officers), so they can't be abused by just one person going rogue.
It can be imagined that we apply the same approach for system administration - "pair-programming" work only, perhaps with proximity cards which detect when one of the admins is actually not at the desk.
- mancerayder 10y agoThat's very theoretical and not analogous because the difference is that sys admins have to do things quickly and under pressure, sometimes at ungodly hours. In contrast the banker has a more relaxing experience putting his signature on a document. It's stressful enough running root commands sometimes, and I can't imagine how horrible it would be to require a second person to be on-call/pair/double-check/etc. I would have long ago quit the profession, which would be impossible to do anything in. Also systems would take longer to fix, so organizations would be displeased. Vet your sys admins correctly before hiring, keep an eye on people's stress levels, which in 2016 America apparently doesn't matter to anyone anymore in IT, and don't piss off the sys admin.
- hcoyote 10y agoThis idea was presented at Usenix LISA a few years back. "Two-Person Control Administration: Preventing Administation Faults through Duplication" by Shaya Potter, Steve Bellovin, and Jason Nieh https://www.usenix.org/conference/lisa-09/two-person-control-administration-preventing-administation-faults-through https://www.usenix.org/conference/lisa-09/two-person-control... The video isn't there for some reason, but the paper and audio of the presentation are.
- Klinky 10y agoHa, some banks can't even put a single required legal signature on documents properly. See: Robo-signing.
- superuser2 10y agoHow does that actually work? I'm tempted to think it's down to one person who validates that two signatures are present.
- compsciphd 10y agoI think the LISA paper does a good job describing an approach. basically don't allow people to commit changes directly to the underlying system, require the changes from 2 administrators to be captured and then compare them for equivalence. (what equivalence means can be bit for bit equality at the most basic binary level, or perhaps some parsing that can verify equivalence at language level for configurations) if the changes are equivalent commit them. otherwise point out the differences. As the paper also discusses, can be used with a single administrator to make the administration auditable, simply capture all changes before they are committed.