3 ms·
I'm not sure what AD has to do with the fact as root, you have a huge amount of power on ANY box and abusing it will get you fired. strace/ptrace is just anoth
by tw04 7y ago
I'm not sure what AD has to do with the fact as root, you have a huge amount of power on ANY box and abusing it will get you fired. strace/ptrace is just another tool in that toolbox that you can use maliciously.
Your company either runs in a model where it trusts the employees or it doesn't. If it doesn't trust the employees they shouldn't be giving ANY of them root on a shared system.
- filleokus 7y agoIn my case, I'm using a different, easy password, for test servers that contain no important production data or are in a especially privileged network position. If they were connected to AD, I would be forced to present my "real" password. On production servers on the other hand, the amount of people with root is probably much smaller, and there might be bigger wins by being able to centrally enforce password policies or whatever the sysadmins want to do.
- lmilcin 7y agoThat was exactly the point. I had separate password on each box (which I did not have to use normally because I use it only to setup ssh key).
- tw04 7y agoSo create a second AD account for the test environment like most shops do?
- ghjkldsf 7y agoBut then you don't get the joy of throwing the baby out with the bath water. 90% of the time someone insists AD is too insecure for them, it's because they're unwilling to maintain hygiene (logging into an untrusted machines with overscoped credentials 8 times a day), or unwilling to use the provided security features (what do you mean use kerberized services? ldap binds work just find and give me an anti-ad security straw man!)
- mlyle 7y agoShared root on an unimportant system with disposable creds is different on shared root on a system that uses (reusable) org-wide creds.