UNIX Systems Control Politics?

pariahdecss asks: "I have just been hired as the webmaster for local college. The website for which I am responsible is hosted 'in-house' and controlled by the college. The server box does not have any other production systems on it besides my website. The website that I have inherited is driven by an amalgam of Embedded Perl and PostgreSQL. Now to the politics...the UNIX Administrator does not want to give me root access to this box. What have others done when faced with this type of systems politics? Is it even possible to function as a full scale webmaster without root access to the box you serve from?"

Comments

Webmaster needs root acces?

[at2000]

I don't think anyone would agree with you.

Which of Perl and Postgresql needs root? If webmasters need root access, then who else don't need?

Re:Webmaster needs root acces?

[harikiri]

Reminds me of an advertisment I saw just a few days ago. The magazine is literally sitting next to me, so let me just grab it to refresh my memory...

...ahh here's the quote:

"How many Developers run as Administrator on their development box? Our research shows 95% or more - despite this being a known practice which introduces deployment and/or security flaws in applications downstream!"

Either way, it's an absolute PITA to do development without the freedom provided by having total access (installing third party packages/software, modifying permissions, configuring services). You can install applications like Sudo to grant elevated privileges on a case-by-case basis, but you have to be serious about it because there's a lot of configuration you have to do if you want to do it properly.

Sidenote: My colleague who used to work for a bank told me a tale where he was not allowed to see what cron jobs were running on a system, but for whatever reason - had been given access to use /bin/cat with sudo. At one stage he "cat" the /var/spool/cron/tabs/xyz (or whatever the path is), in order to find out why some process was hogging the system resources. When he offered a suggestion on how to improve it - the admin looked at him oddly and was like "how do you know what cron jobs are running!?"

Yes

[metalhed77]

It's entirely possible to function without root. Albeit to a limited extent. You have to ask your admin to install / upgrade software for you, but do it enough and maybe he'll get sick of it and give you root. Next?

Re:Yes

[NemoX]

Or, do it enough and piss him off so that a policy will be put in place to start a versioning system with installation time tables. I have seen this backfire in favor of the admin before.

Webmasters are more lined up with programmers these days (think maybe .jsp, .aspx, etc.). And I can guarantee you that those programmers don't have root access to the web boxes in an environment that is properly set up. Why? Because they are programmers, not administrators...just as a webmaster is exactly that, and not an administrator. If you want root, you will need to prove that you are a capable UNIX administrator. Best thing to do if you want root, is to be his understudy and learn from him. Then, in time, when you are knowledgeable enough, you will get root. I doubt that you already have that knowledge since webmasters get paid much, much less that UNIX admins, so if you had it you would be a UNIX admin somewhere that would be paying you a heck of a lot more. Until then, sit back and enjoy the ride.

Re:Yes

[Geoffreyerffoeg]

It's entirely possible to function without root.

I webmaster the site for our state's math club chapter, which uses ASP/Access for online registration (not my choice - this is an inherited site, and our host is on NT). All I've got is FTP. I can function as well as I need. Exactly what do you need even non-root shell access for? All you should need to do is edit files and change stuff on the database...and the database should let you use a local client.

What exactly is a "full-scale webmaster" other than a system administrator also?

Re:Yes

[rtaylor]

Albeit to a limited extent. You have to ask your admin to install / upgrade software for you, but

Heck, It's PostgreSQL, Perl and Apache. None of those needs to run as root, be owned by root, etc.

Just get a few gigs of diskspace in your home directory and go from there. Since this person can be trusted as root, surely they know how to compile software to places other than /usr/local (or default path of choice).

Why do you need root?

[mjpaci]

Please, let us know why you need root and we'll then tell you 1) how to attain it using politics or 2) that you're being a baby.

--Mike

sudo

[xmas2003]

sudo is a great tool to control and log root access - if the UNIX Admins aren't using this already, they should be.

So document exactly what you REALLY need sudo access for, and *if* there is a business case justification, then they should be able to grant this on a per command basis. There should be no reason for a webmaster to "need" the root password.

No

[cookiepus]

You're the one trying to do politics. Your domain as webmaster is html files, scripts, etc. You don't need to have root pass to upload files. Everyone who uses someone else's system for hosting is a webmaster w/o root access to the server. The two things are unrelated.

As your sysop to do things whenever you don't have access to do something (set up a db?) If this happens often enough he'll reconsider the policy, but most likely you will be just fine w. the privileges you have.

SUDO

[missing000]

I'd just ask for sudo access to the resources I needed. Also, you never said why he denied access. Does the system have trust relationships with other systems he want's you out of?

Government Systems

[digitalchinky]

For the first several years working for DSD there was no way in hell they were going to give me root access to anything, my data and home directories could be measured in the tens of gigabytes just to overcome these limitations. That was solaris, unfortunately (in my opinion) to get anywhere near the same functionality (as root access) you'll spend a huge amount of time recompiling applications, tweaking config files to do things that probably nobody ever intended, along with being on your supervisors shit list for blowing out disk space, audit trails, and... well... just because...

Not easy.

No.

[epsalon]

Diebold systems control politics.

Oh, you meant politics of UNIX system control? Never mind.

You just need 2 environments

[Gothmolly]

Test, and Production. Build a linux box, give yourself root, do all your play work there. When its time to make real changes, in 1 shot, ask the SA to do whatever you need (upgrade PHP to version foo, edit config file bar, etc). They're more likely to do it if you don't nickel and dime them every day for little stuff. Plus, you have the added bonus of not fscking up your main, real, this-is-your-paycheck website doing test work.

Inherit the whirlwind

[AndroidCat]

You don't say anything about what else you inherited along with the website: Was the previous web admin a jerk? Was the server a pustulent boil on the face of the university's net?

Not Everything Requires Root

[thenerdgod]

You should only need root-style access to do one thing, and that's restart apache. And if your sysadmin uses, say, iptables/ipfilter, he could just redirect port 80 to some port above 1024 and then you wouldn't even need root at all! Quit whining!

"But Wait!" you say, "What about software upgrades? New Perl modules?" --Sorry, bub, installing and upgrading software is exactly what the sysadmin is there for. These are her systems. Not yours.

It's likely your sysadmin is smarter than you, and has been doing this longer. And while I'm sure you have "teh lunix" at home and run X as root "all the time", that doesn't make you worthy of having root on the universitie's box. Quite frankly, having been through this from the sysadmin's side, No, you don't need root, and it's YOU who's playing the political game, not them. It's their box, their system, their software. The limousine company owns the cadillac, you just drive it around and make sure it has gas. Thank you. Move along!

You've mentioned nothing of your skill set ...

[dougmc]

Now to the politics...the UNIX Administrator does not want to give me root access to this box.

Well, who's going to have to fix the box if you break it? The UNIX Administrator, probably.

You've not mentioned anything of your skills or previous experience. `Webmaster' could mean that you're a skilled systems administrator and/or programmer yourself ... or it could mean that you spent 15 minutes playing with Frontpage and Photoshop. Or anything in between.

What have others done when faced with this type of systems politics?

It's a university, so things may be different, but in the business sector, one makes a business case for needing root access, and puts that, plus the pros and cons into a presentation and presents that to management and the systems administrator. If you have the needed skills, and can convince people that having root access would make for a better web site, the sysadmin may be happy to let you have access to your box (because it may mean less work for him.) At least in the business world, politics definately exist, but a good business case can often cut through it like a knife through butter. (It's unfortunate when skilled sysadmins and programmers have to spend their time making Powerpoint presentations, but it's often how you deal with the suits.)

But if you're some `loose cannon' who doesn't know anything about *nix system administration beyond what you've read in some book, then root access is a disaster waiting to happen.

(As I said, I don't know which group you fit into.)

Is it even possible to function as a full scale webmaster without root access to the box you serve from?

It sounds like you've already answered your own question, and want us to come up with the same answer. `full scale webmaster?' In any event, my answer is `yes', which is probably not the answer you want to hear.

Not having root access is a blessing in disguise too. If something gets really messed up and root access is needed to fix it, you have the benefit of 1) not being blamed for it, because you couldn't have done it, and 2) not having to fix it.

One piece of advice -- what ever happens, don't try to `crack' root access. Getting caught, even if you think it helps you do your job, is likely to end in your being fired, and could even find you being arrested. (Yes, it has happened.) If you're a student, you could even be expelled. Not worth the risk.

Your answer

[Safety Cap]

"~ the UNIX Administrator does not want to give me root access ~. ~ Is it even possible to function as a full scale webmaster without root access to the box ~?"

This article advocates a

( ) technical ( ) legislative ( ) market-based (x) vigilante

approach to website administration. Your idea will not work. Here is why it
won't work. (One or more of the following may apply to your particular idea,
and it may have other flaws which used to vary from organization to
organization before a poorly thought-out, ineffective approach is suggested.)

(x) Sudo will allow you to do what you need
( ) Installing extra software on a machine without the Admin's knowledge
is bad
(x) You don't know what you're doing
( ) Hosting w4r3z and hacks on company-owned equipment is bad
( ) You are not mature enough to manage a box in a production environment
( ) Your users will not put up with it
( ) SCO will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from the Admin
(x) Requires immediate total cooperation from everybody at once
(x) Your employers cannot afford to lose services or alienate students
( ) Students don't care about your lack of web admin skills
(x) Anyone could anonymously destroy your entire site due to your
inept administration skills

Specifically, your plan fails to account for

( ) University rules expressly prohibiting it
(x) Lack of centrally controlling authority for servers
( ) 5kr!pt k!dd!35 installing open relays
( ) Backup and restore
( ) Asshats
( ) Jurisdictional problems
(x) Unpopularity of weird new configurations
( ) Students' reluctance to use an obviously hacked site
( ) Huge existing software investment current setup
( ) Susceptibility of poorly configured machines to attack
(x) Your willingness to install OS patches in a timely manner
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Extreme fun of web h4xx0r5
( ) Joe jobs and/or identity theft
( ) Technically illiterate school administrators
(x) Extreme stupidity on the part of people who think they need root
in order to do their job
( ) Bandwidth costs that will increase once the b0xx3n are pwned
( ) IE

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever been
shown practical
(x) Any scheme based on 'su' is unacceptable
( ) Lack of knowledge upon how to manage a web server should not be the
subject of politics
( ) .htaccess sucks
( ) mysql sucks
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of campus networks
( ) Countermeasures must work if phased in gradually
( ) Surfing the web should be easy
(x) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(x) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time root access is cumbersome
( ) I don't want the campus regents looking over my shoulder
( ) Web admins who have been coasting along with barely any knowledge
of what they're doing should be killed in a way is slow and painful

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid person for suggesting it.

What kind of Webmaster?

[Androclese]

Are you talking the modern Webmaster where their skill sets are limited to the design and content of the website or the Old-School Webmaster (like me) where you were responsible for everything like the OS, the software (Apache, mySQL, Perl, PHP), access (.htaccess, etc.), and the content (HTML, images, etc.)

If you're talking a Modern webmaster, then no, they don't need it. The Server Admin just has to make sure all the directories they are using are owned by the assigned user.

If you're talking Old-School, then yeah, it's pretty much a necessity; sudo at a minimum.

Re:What kind of Webmaster?

[M1FCJ]

Nope, still not necessary. Apache/MySQL/perl/PHP can be compiled and installed anywhere you like and doesn't have to be owned by the root. All of these (if applicable) can use unpriviledged ports and the only thing the root has to do is use iptables/ipfwd rules to make sure it is accessible as if they are running on priviledged ports. This is applicable especially if you are old-school, you should know how to change mysql's default listening port. Any odd idiot might not know how to do this but you probably would.

As for the contents and access, they are all files on a file system. Given the right access, you don't need more.

Even more importantly, as a secure site policy, webadmins should never have root accesses, in case the webadmin's account gets hacked into, they should not even be able to see inside the system. In some scenarios a chroot jail might be the best solution. Still no need for root access. That'd be just stupidity.

You don't need it

[dimss]

You can run Apache, perl and PostgeSQL without being root. Ask your admin for two things: port 80 mapping to 8080 and calling your startup.sh after boot (I do so in rc.local). And you're there.

I've been on the sysadmin side

[blargh-dot-com]

At a largish-university. There would be (and was) no way a webmaster would have root access to any boxen I controlled. For a number of reasons:

a) You don't need it. Making sure apache is up and running and patched is my job, and I probably do it to 50 boxes at once and have nice automated scripts.

b) Every single webmaster I met (until I left a few months) ago swore they needed root access to install some apache module or other. No, you don't. You ask the sysadmin and, most times, if he can do it without a huge amount of effort (pointing him to the exact URL of the module's home page, and even better, pre-compiled packages for your OS, would tend to improve his/her mood) then I will, after carefully evaluating it, its security, its size, etc.

c) Politics sucks, and the poor sysadmin generally has to fight tooth and nail for every little bit he/she can get. Going the political route and over your sysadmin's head is a very good way whatever box you end up controlling has a number of... strange issues. Not saying I did this, but I know a LOT of sysadmins who have. A LOT. A lot of people you normally wouldn't expect. Especially in a university or state-run organization, politics and political image counts for a lot, and if you use politics to override your sysadmin, they're going to be very bitter about it. Not a good idea at all.

d) Working with the sysadmin, if you can provide a DAMN good case, and actually show you know what you're doing, what will usually happen is the sysadmin will hand over root and wash his or her hands of the matter. Box gets owned? Your problem. Box goes down? Your problem. Operating system barfs? Your problem. Too many people having root is a terminally bad idea, and most sysadmins will avoid it like the plague.

e) If all you need is the ability to restart/reload apache, there are a number of other ways to accomplish that, as has been mentioned. Personally, I would have gone the 80->8080 route, because I didn't hand out sudo either. :)

Fscking Unter-grads

[Anonymous Coward]

Every year I have to hear about this bullshit.

Listen kid, we're going to tell you this now, don't forget this lesson. You are not special. You are not the brightest little ray of knowledge to ever grace the halls of your university. In fact, the odds are very much that you are aren't even good enough to be the layer of slime the illumnai pond scum will float on. There are 10,000 other eager little faces just like you. And the odds are you aren't anywhere near the top end. If you were, the faculty would be putting you to better use than being the webmaster. Any idiot can be the webmaster, quite successfully, however, giving that idiot root would endanger the system the sysadmin is charged to maintain.

To summarize:
1) You are not special
2) You are should simply be happy you beat out those not smart enough to be webwanker
3) You should put your little ego at the door and realize the sysadmin is only doing his job, if he were stupid enough to hand you root, he should be fired.
4) Webwanking is not a technical task.
5) Webwankers *SHOULD* *NEVER* *EVER* have root. It *ALWAYS* ends badly, at my university we have a policy that says just that. And many defacements have been avoided because of it
6) Grow up! The sysadmin is getting sick of hearing this bullshit year after fucking year!

Re:Fscking Unter-grads

[Farmer Jimbo]

1.) If I had mod points I wouldn't be posting this reply.

2.) I had forgotten how truly evil it can be to work with 20 year old's who think they know everything.

3.) I remeber being 20 and thinking the world was so lucky to have me. Thank god someone older and wiser stepped on me hard and made me realize I was being a snot.

How-To do Politics . . .

[Dausha]

First, get politics for dummies. Also, you don't need root, as has been said ad nausium. The fact that you are asking if you need root to be a full fledged web master demonstrates that you don't know what you're in for politically or technically. Odds are your admin is reading this thread and will know its you.

However, I'll give you the loaded gun. Go ye therefore . . .

1. Don't rock any boats for 90 days. You need this time to assess the political landscape and get to know who is really in control. You may find that the man in charge is not the man in control. If you start rocking your boat early, the man behind the curtain will be wise to you. IF that man is the sys admin you're trying to sweep the legs out from under, then clean up your resume.

2. Get to know the system you're wanting to control. You need to know why you need root to ask for it. Needing to install software is usually the best excuse since routine permissions will fix any routine need for root. This also requires some major server overall that you *need* to get the website to some grand plan you have. You do have a grand plan, right?

3. After the requisite time period (see 1), start making a lot of important installation requests staggared. Make sure you ask for it when he's swamped. That way he will seem unsupportive/inept. Don't forget to explain to man in control that you're not being supported.

4. Explain to the man in control that if sysadmin would only give you root, you could take care of this on your own. Don't forget to wave your hand in front of the man in control or the jedi mind trick will fail. Hope that man in control and sysadmin are not friends.

5. Hope that sysadmin is not politically savvy. If he is, prepare your resume. You have about a 25 percent chance of winning if you know what you're doing, and a 100 percent chance of pissing off your sysadmin.

If he's worth his salt, once you have effectively stolen root from him, the server will have mysterious problems arise that can *only* have been because he was forced to give you root. Root will be taken from you and you will have a) made a serious enemy and b) "proven" your incompetence.

The net result is that you will have weakened the organization as a whole.

Alternatively, you can work your ass off for several months to impress the hell out of all involved and show that you can be trusted with root. No politics required.

My 2 cents

[eyeball]

There seems to be a lot of 'you don't need root access' replies. I'd go so far as to say 'avoid root access if you can,' especially in a politically volatile environment. You'll get less blame when something goes wrong, and you can relax while they take care of the system patching, managing its network connectivity, disk space, etc.

Working on a non-root server feels weird at first if you've run your own box for a long time, but other than the inability to listen on ports 1024 and a few minor resource restrictions, you should be better off. Coexisting on someone else's server can even make you very conscientious and more likely to keep a tidy server.

Also, if you have to ask the administrator to upload files every time you change them, and you find yourself making many changes, ask yourself if you are doing too many updates because you don't have a proper test/dev/stage environment (if not, shame on you!). If not, maybe a compromise could be made to script a bulk site transfer from stage to production that you could control.

Developers should have root.... on dev boxes.

[agristin]

No developer should have root on PRODUCTION boxes.

The process should be:

development happens on development box (workstation, server whatever). Developers may have root on this- if they do, they manage it, OS hardware and all. Developers will use sudo if anyone else is responsible for the server hardware and OS. This should never be exposed to untrusted networks.

QA stage: if you are poor or small, do this against the development box. If not this should be a seperate QA box. This should be managed by QA team. If the sysadmin is the same, the sysadmin should hold root, qa team may sudo, developers should not be accessing this box directly (except in emergency, then they will be sheperded by QA). This should also not be exposed to untrusted networks unless you have and excellent (and obeyed) security policy and review.

Production: only the sysadmin has root, noone else should have access. The sysadmin publishes to production- using the release that QA approves. Highest security policy applies here.

If your QA and dev team are the same, collapse development and QA- but trust me keep production seperate.

-A