🚀 go-pugleaf

Barry Margolin wrote:

> Anyone who has worked in a few different organizations can probably
> describe common habits of sysadmins and recognize something that's
> extremely unusual.  For something like this, a comprehensive survey is
> hardly necessary.

  I agree -- but it's not the sysadms who need to be convinced in this
case. It's the people who decided that this protection mechanism was
required, as well as the people who made it into a rule. Will your
argument convince them? It may, if they trust their sysadms.

  But probably not. Then it becomes a procedural question: what does
it take to change a security rule?  (A good security policy should state
that mechanism...)

  Refusal to follow the rule may be taken as an indication of a problem
by a reasonably enlightened management.  If that is a likely path forward,
it might make sense to wait until the first verification is made that the
rules and policies are implemented.

  --

  Further ruminations:

  It seems that the rule is a 'last line of defense' kind of rule. I
don't believe it's wise to place the implementation of such rules
entirely in the hands of users, without any support.

  Is there any shell that is capable of protecting PATH from malicious or
accidental modification? If there is, using it might be a better
solution to the problem. 

-- 
Anders Thulin     Anders.X.Thulin@telia.se     040-10 50 63
Telia ProSoft AB, Box 85, SE-201 20 Malm�, Sweden