UNIX Systems Control Politics?

pariahdecss asks: "I have just been hired as the webmaster for local college. The website for which I am responsible is hosted 'in-house' and controlled by the college. The server box does not have any other production systems on it besides my website. The website that I have inherited is driven by an amalgam of Embedded Perl and PostgreSQL. Now to the politics...the UNIX Administrator does not want to give me root access to this box. What have others done when faced with this type of systems politics? Is it even possible to function as a full scale webmaster without root access to the box you serve from?"

Comments

Webmaster needs root acces?

[at2000]

I don't think anyone would agree with you.

Which of Perl and Postgresql needs root? If webmasters need root access, then who else don't need?

sudo

[xmas2003]

sudo is a great tool to control and log root access - if the UNIX Admins aren't using this already, they should be.

So document exactly what you REALLY need sudo access for, and *if* there is a business case justification, then they should be able to grant this on a per command basis. There should be no reason for a webmaster to "need" the root password.

SUDO

[missing000]

I'd just ask for sudo access to the resources I needed. Also, you never said why he denied access. Does the system have trust relationships with other systems he want's you out of?

You've mentioned nothing of your skill set ...

[dougmc]

Now to the politics...the UNIX Administrator does not want to give me root access to this box.

Well, who's going to have to fix the box if you break it? The UNIX Administrator, probably.

You've not mentioned anything of your skills or previous experience. `Webmaster' could mean that you're a skilled systems administrator and/or programmer yourself ... or it could mean that you spent 15 minutes playing with Frontpage and Photoshop. Or anything in between.

What have others done when faced with this type of systems politics?

It's a university, so things may be different, but in the business sector, one makes a business case for needing root access, and puts that, plus the pros and cons into a presentation and presents that to management and the systems administrator. If you have the needed skills, and can convince people that having root access would make for a better web site, the sysadmin may be happy to let you have access to your box (because it may mean less work for him.) At least in the business world, politics definately exist, but a good business case can often cut through it like a knife through butter. (It's unfortunate when skilled sysadmins and programmers have to spend their time making Powerpoint presentations, but it's often how you deal with the suits.)

But if you're some `loose cannon' who doesn't know anything about *nix system administration beyond what you've read in some book, then root access is a disaster waiting to happen.

(As I said, I don't know which group you fit into.)

Is it even possible to function as a full scale webmaster without root access to the box you serve from?

It sounds like you've already answered your own question, and want us to come up with the same answer. `full scale webmaster?' In any event, my answer is `yes', which is probably not the answer you want to hear.

Not having root access is a blessing in disguise too. If something gets really messed up and root access is needed to fix it, you have the benefit of 1) not being blamed for it, because you couldn't have done it, and 2) not having to fix it.

One piece of advice -- what ever happens, don't try to `crack' root access. Getting caught, even if you think it helps you do your job, is likely to end in your being fired, and could even find you being arrested. (Yes, it has happened.) If you're a student, you could even be expelled. Not worth the risk.

I've been on the sysadmin side

[blargh-dot-com]

At a largish-university. There would be (and was) no way a webmaster would have root access to any boxen I controlled. For a number of reasons:

a) You don't need it. Making sure apache is up and running and patched is my job, and I probably do it to 50 boxes at once and have nice automated scripts.

b) Every single webmaster I met (until I left a few months) ago swore they needed root access to install some apache module or other. No, you don't. You ask the sysadmin and, most times, if he can do it without a huge amount of effort (pointing him to the exact URL of the module's home page, and even better, pre-compiled packages for your OS, would tend to improve his/her mood) then I will, after carefully evaluating it, its security, its size, etc.

c) Politics sucks, and the poor sysadmin generally has to fight tooth and nail for every little bit he/she can get. Going the political route and over your sysadmin's head is a very good way whatever box you end up controlling has a number of... strange issues. Not saying I did this, but I know a LOT of sysadmins who have. A LOT. A lot of people you normally wouldn't expect. Especially in a university or state-run organization, politics and political image counts for a lot, and if you use politics to override your sysadmin, they're going to be very bitter about it. Not a good idea at all.

d) Working with the sysadmin, if you can provide a DAMN good case, and actually show you know what you're doing, what will usually happen is the sysadmin will hand over root and wash his or her hands of the matter. Box gets owned? Your problem. Box goes down? Your problem. Operating system barfs? Your problem. Too many people having root is a terminally bad idea, and most sysadmins will avoid it like the plague.

e) If all you need is the ability to restart/reload apache, there are a number of other ways to accomplish that, as has been mentioned. Personally, I would have gone the 80->8080 route, because I didn't hand out sudo either. :)

Re:Yes

[Geoffreyerffoeg]

It's entirely possible to function without root.

I webmaster the site for our state's math club chapter, which uses ASP/Access for online registration (not my choice - this is an inherited site, and our host is on NT). All I've got is FTP. I can function as well as I need. Exactly what do you need even non-root shell access for? All you should need to do is edit files and change stuff on the database...and the database should let you use a local client.

What exactly is a "full-scale webmaster" other than a system administrator also?

Re:Yes

[rtaylor]

Albeit to a limited extent. You have to ask your admin to install / upgrade software for you, but

Heck, It's PostgreSQL, Perl and Apache. None of those needs to run as root, be owned by root, etc.

Just get a few gigs of diskspace in your home directory and go from there. Since this person can be trusted as root, surely they know how to compile software to places other than /usr/local (or default path of choice).

My 2 cents

[eyeball]

There seems to be a lot of 'you don't need root access' replies. I'd go so far as to say 'avoid root access if you can,' especially in a politically volatile environment. You'll get less blame when something goes wrong, and you can relax while they take care of the system patching, managing its network connectivity, disk space, etc.

Working on a non-root server feels weird at first if you've run your own box for a long time, but other than the inability to listen on ports 1024 and a few minor resource restrictions, you should be better off. Coexisting on someone else's server can even make you very conscientious and more likely to keep a tidy server.

Also, if you have to ask the administrator to upload files every time you change them, and you find yourself making many changes, ask yourself if you are doing too many updates because you don't have a proper test/dev/stage environment (if not, shame on you!). If not, maybe a compromise could be made to script a bulk site transfer from stage to production that you could control.