🚀 go-pugleaf

In article <1992Jul31.180107.2263@midway.uchicago.edu> h309@midway.uchicago.edu writes:
>If root suspected a user of some foul play, such as a trojan horse login
>program, etc. Does root have the right to look through the user's 
>directory without the user's permission? It would kinda be like rummaging
>through a person's house without a search warrant....
>
We've adopted the following policy.

  1.  make a backup/dump of the user's directories without looking at
      the specific items.  This has the effect of sequestering the
      evidence.

  2.  Present our suspicions to the approppriate campus judicial body
      (students and faculty have different ones), asking them for the
      equivalent of a search warrant -- in other words, do we have 
      sufficient grounds to merit privacy intrusion.

  3.  If authorized, then we can play back the dump/backup to look 
      for incriminating evidence.  If a "smoking gun" is found, the
      campus judicial group decides upon appropriate punishment.

  4.  If denied, then the backup/dump is erased.

The "search warrant" model offers a good check against overly eager
computing staff and assures that your position has been reviewed by
the institution.  It also assures that your actions remain in sync
with whatever other procedures are in place at your institution.






-- 
Leo Geoffrion, Skidmore College Computer Services, Saratoga Springs, NY 12866
EMAIL: ldg@scott.skidmore.edu   VOICE: (518) 584-5000 Ext. 2919