- This topic has 2 replies, 2 voices, and was last updated 19 years, 6 months ago by
.
-
Posts
-
why are accountants so paranoid? like the system admin’s going to go in and read all the company’s financial data, decide he’s not getting paid enough, then post it all on his blog….
oh yeah. that would be bad.
even so, i’ve been asked by a client to migrate the accountant’s home over to the server – easy enough, i’ve done it already with all the other users. however, they’d like me to make it so that *only she* can access its contents. not even the server admin (me) or anyone else with admin access (CEO, etc) should be able to see what’s in her home directory. not even root, if someone were to log in at the console.
what i’ve told them is that anything that lives on the server is ultimately accessible by root, and the admin group has sudo root access. at least they have the password (“how do we fix things when you’re not here?”)
sigh.
feasible? advisable?
for extra bonus points, the accountant in question is running, you guessed it, windows XP. so, we’d need to talk about a windows home directory living on 10.4 server, accessible via SMB, and secured to the standards above.
it’s so much easier working with designers.
In our company, information that requires such strigent security is kept on encypted disk images. Is there any reason that wouldn’t work for you?
If you decide on such a solution, educating users that information stored in an encrypted image can not be retrieved by any means if the password is lost. Most users have the expectations that admins can reset the password for anything. I’m constantly being asked to change people’s passwords for AOL IM…
macshome wrote:
You can probably work this out with ACLs for the most part. Remember too that sudo isn’t the keys to the whole box. You can easily provision what people can do with sudo.
Our SarBox auditors aren’t comforatable using permissions or ACLs to protect certain data, because server admins can change them. That’s why we had to go with Disk Images.
- You must be logged in to reply to this topic.