Sponsored Content
Full Discussion: Vendor root access
Top Forums Programming Open Source Vendor root access Post 302975274 by zaxxon on Friday 10th of June 2016 04:22:40 AM
Old 06-10-2016
What makes you sure that they don't need root access? There are of course commands, that can be only issued as root. Sure they can be added to sudoers, but they would have to list every one of them so you can allow them but this might be somewhat tideous.
It can also be of course for the ease of installation, that they ask for root access, which I do understand.

Yes, there are installations that can only be done as root or at least partially. When this is the case, there is usually some admin sitting next to them to at least check what they do. It should be inhouse and via remote session. That could be a criteria, that a software is only allowed on your systems when it can be setup with an own user in the selection process of a software before it is bought.

Though - there can always come code on your machines, that could do harm in terms of spying or destroying/manipulating data.
I doubt strongly, that anyone does a full code check of the software that is being installed on their systems even if it does not run with root permissions. For example - does anybody know what is in the complete code of an Oracle RDBMS installation? It is not even open source.
Even if it was open source software, who has the time, knowledge etc. to check every line of code if it has anything malicious in it.

Also usually most servers are placed in an internal network, protected by one or more firewalls, as long as you are no hosting company (they might have some mechanisms too, but I have no experience about it).
So any gathered data usually can not be sent outside your companies network as it would bounce against the firewall and hopefully alert the network guys for irregular communication.
There is still other ways to get the data out of the company, but this is broad and complex thing, which should be an issue for the security guys in the company.

And as Don says, it is always a question of trust and also of legal rules and liability in contracts with vendors which takes a big part in what you let them do or not.
You sometimes have to make compromises between security and get the stuff up and running.

Something like an IDS (AIDE, Tripwire, ...) can also be very good to check what will be modified on your systems. Also an audit system can come in very handy to log, what they do for later issues. These together with a good firewall handling will make ones life a tad less stressful in terms of security. Though you are right to have concerns and not let it pass half asleep Smilie

Last edited by zaxxon; 06-10-2016 at 06:55 AM.. Reason: update after some additional thoughts
This User Gave Thanks to zaxxon For This Post:
 

10 More Discussions You Might Find Interesting

1. Linux

how to access root priveliges if root password is lost

wish to know how to access root password it root password is forgotten in linux (1 Reply)
Discussion started by: wojtyla
1 Replies

2. SCO

root access

We have SCO 5.0.5 and can't log into system as "root". The system indicates the password is incorrect. No one knows what happened. How can we resolve this issue.. Are there files we can restore from backup...? Any suggestions would be appreciated. Thank you.. (2 Replies)
Discussion started by: RBurer
2 Replies

3. Shell Programming and Scripting

To What files root does not have access to??

Hi, I just wanted to know to what files root does not have access, not even read....I read that .profile for any user is the only file which root cannot access is it true..??...If we have to use passwords and ID's in a script can we use them in .profile and call them as parameters..??? ... (3 Replies)
Discussion started by: mgirinath
3 Replies

4. Solaris

Security of root access

Hi, The security auditor give a this statement , what to do ? On my solaris system (S10) "The User ID "root" should not be used on the system - the su and the priviledged account should be used from each administrator for accountability purposes" What to do ? (3 Replies)
Discussion started by: falcon16
3 Replies

5. AIX

root access

Hello I have a question. I have a box with Aix 5.3 but I want to disable root access direct from any terminal or console. I mean If I want to login to 10.10.10.10 login:root password ********* Root access is not permited Which file I have to edit. to the users first login with... (4 Replies)
Discussion started by: lo-lp-kl
4 Replies

6. UNIX for Dummies Questions & Answers

How to allow access to some commands having root privleges to be run bu non root user

hi i am new to unix and i have abig task. i have to \run particular commands having root privileges from a non root user. i know sudo is one of the way but i need sum other approach kindly help Thanks (5 Replies)
Discussion started by: suryashikha
5 Replies

7. Shell Programming and Scripting

How to give root access to non root user?

Currently in my system Red Hat is installed. And Many user connect to my machine via SSH Techia Terminal. I want to give some users a root level access. Can anyone please help me how to make it possible. I too searched on the Google but didn't find the correct way Regards ADI (4 Replies)
Discussion started by: adisky123
4 Replies

8. SuSE

Auditors want more security with root to root access via ssh keys

I access over 100 SUSE SLES servers as root from my admin server, via ssh sessions using ssh keys, so I don't have to enter a password. My SUSE Admin server is setup in the following manner: 1) Remote root access is turned off in the sshd_config file. 2) I am the only user of this admin... (6 Replies)
Discussion started by: dvbell
6 Replies

9. Ubuntu

Root access that can't change root password?

We are having a little problem on a server. We want that some users should be able to do e.g. sudo and become root, but with the restriction that the user can't change root password. That is, a guarantee that we still can login to that server and become root no matter of what the other users will... (2 Replies)
Discussion started by: 244an
2 Replies

10. OS X (Apple)

Root access in OSX 10.12.2.

Mac users... I updated this MBP from OSX 10.12.1 to the brand new OSX 10.12.2 two days ago. A week ago I installed the Xcode suite. Now the QT shell audio capture in another recent thread is broken when exporting a file. It gives an error in a window, paraphrasing, The action is not... (4 Replies)
Discussion started by: wisecracker
4 Replies
CUTTER(8)						      System Manager's Manual							 CUTTER(8)

NAME
cutter - cut tcp/ip connections SYNOPSIS
cutter ipaddress1 [ port1 [ ipaddress2 [ port2 ] ] ] DESCRIPTION
Cutter is an open source program that allows Linux firewall administrators to abort TCP/IP connections routed over the firewall or router on which it is run. WARNING
Cutter has been designed for use as a administrators tool for Linux firewalls. It's use (as is, or modified) for any other purpose is not sanctioned by the author. So - do not use this tool as a parachute, or to dry your cat, chill meat, answer your phone, drive you car, teach your kids to read or attack other people's computer systems or networks. This software has been designed for legal and appropriate use by network security administrators and the like. It has been written as part of a larger Linux firewall project, targetting at controlling traffic from peer-to-peer software such as Kazaa, iMesh and others into and out of a private network. It is not designed as a tool for malicious use and the author in no way sanctions such use. Users of the software should be aware that it's actions are easily detectable using a number of readily available network monitoring tools, and it makes no attempt to disguise it's actions. Malicious use of "cutter" could result in a jail sentance in a number of countries around the world. The author is not responsible for the results of using this software. It is provided "as is" in the hope that it will be useful, but no garantees are made about it's use. USAGE
Cutter can be called using one of the following four syntaxes. cutter ip-address Example: cutter 10.10.0.45 Cuts all connections passing through the firewall between any ports on the specified ip-address (either a "private" or "public" address) and any other hosts. This can be used to close down all incoming connections to a particular server, all outgoing connec- tions from a particular client or all outgoing connections to a server. cutter ip-address port Example: cutter 200.1.2.3 80 Cuts all connections to or from the specified ip-address/port pair. This allows the user to be a little more specific than the pre- vious example and allows targetting of specific services on specific hosts. cutter ip-address-1 port-1 ip-address-2 Example: cutter 200.1.2.3 22 10.10.0.45 Cuts all connections between ip-address-2 and ip-address-1/port-1. This allows the user to cut connections between a specified "client" and a particular service on a specified host. Our example closes host 10.10.0.45's SSH connection to server 200.1.2.3. cutter ip-address-1 port-1 ip-address-2 port-2 Example: cutter 200.1.2.3 22 10.10.0.45 32451 Cuts the specific connection between the two ip/port number pairs given. STATUS
Cutter 1.03 should be considered EXPERIMENTAL. The author is releasing a tool that works on the systems he has access to (namely: IPCop and RedHat Linux), and he is seeking input on it's use on other systems, ideas for improvement, offers of sponsorship - etc. ADDITIONAL DOCUMENTATION
This program is documented at http://www.lowth.com/cutter/ <http://www.lowth.com/cutter/> AUTHOR
Blars Blarson addapted the README and web page written by Chris Lowth into this man page for debian package of cutter. This man page may be distribuated under the terms of the Gnu GPL version 2. April, 2005 CUTTER(8)
All times are GMT -4. The time now is 02:14 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy