In the late 1980’s we developed a procedure involving a safe in operations and
envelopes that allowed the (that’s right, the, as in one) Unix system
administrator to get some sleep.
Four or five persons were certified as “non-full time” root access via sudo. In
the safe was an envelope for each person and new (and existing) operators were
schooled on how to identify that the person calling was indeed the person
entitled to the contents of the envelope.
When a need for root arrived when the system administrator was off duty and the
relevant “non-full time” rooter was pretty sure nothing beyond their certain
knowledge was required to address the need (most often installing Oracle, as a
matter of fact) then the envelope was accessed. A full log of root activities
was recorded and the non-full time rooter closed out the issued with a full
report to the SA and the IT Director. When the SA was next available that
person’s root password was changed, the log was reviewed, and a new password
for that person was put in the safe.
I can’t remember whether we wrote this procedure up as part of the MOSES papers
or not.
mwf
From: oracle-l-bounce@xxxxxxxxxxxxx [mailto:oracle-l-bounce@xxxxxxxxxxxxx] On ;
Behalf Of Howard Latham
Sent: Wednesday, March 23, 2016 8:39 AM
To: ORACLE-L
Subject: Security Wonks ate my hamster.
Our IT Director has decided only he will have root access to out 4 linux
Database Servers . And the password will be held in a safe, Does these mean I
can no longer do the administration or Linux / Oracle or does his idea of
creating new account solve it?
--
Howard A. Latham
