🚀 go-pugleaf

Hi all,

I have a (hypothetical) situation which I'd appreciate
some comment on.  I've tried to be as exact as possible,
but if you want any clarification just mail away.

Machines XX and YY belong to different departments - each
machine's maintenance, support and associated staff being  
paid for by the relevant department.  Whilst each machine
is run separately, they do have some users in common.  
There are no shared filesystems between XX and YY though
they are on the same network, and it is possible to 
login to each machine from the other.  

Let's say A is a non-administrative user who has an acount
on both XX and YY.  The administration on XX has specifically
forbade the use of program I on their machine, either directly
or while remote-logged in to program YY.  There is no such
restriction on machine YY.  So, user A logs into
host YY, compiles up program I, and leaves the binary in his
account on YY.  The next day, A logs on to YY to use his
newly-installed program, only to find that the binary has
been deleted during the night.

So, person A questions the administrator on YY as to why his 
binary was deleted.  YY's admin is surprised at the question
because he certainly didn't do it.  In fact, on checking
through the system logs, it looks like A deleted his own file.
A knows he didn't do it either, and that the chances of his
password being cracked are infinitesimal, since he only changed
it yesterday, and it was a reasonable password.

He does, however, have a .rhosts entry on YY allowing him to 
login from XX, and indeed, the system logs show that this 
took place last night. However again, A didn't perform this login.
In fact, he'd changed his password on machine XX yesterday, 
and on checking through the system logs on XX which just 
happen to be publicly readable, the only person using XX 
at the time of the remote login, was XX's system administrator.

Now, all questions of technical security aside, the evidence
seems to point to the admin on XX impersonating A and removing 
the file belonging to A.

If this is in fact the case, then:
	1)	What are the legal implications (if any)
		of the XX admin's actions?
	2)	If A logs in to YY from XX and uses his
		program, does this give the XX admin the
		right to act as he did?
	3)	What would you do in the XX admin's place?
	4)	What would you do in A's place?
	5)	What would you do in the YY admin's place?

If the admin didn't in fact "do it" then the question remains:
		"whodunnit?" ;-)


Thanks in advance,

Mike


ps.	This is a question aired for my own personal interest.  
	Any views/opionions/etc are my own and not those of my
	employer.  The situation above is fictional.
--
-----------------------------------------------------------------------------
Mike (mark) Ciavarella                  email:   markc@arbld.unimelb.EDU.au
System Administrator                    phone:   +61-3-344-4648 (voice)
Dept. of Architecture & Building                 +61-3-344-5532 (fax)   
Unversity of Melbourne, Australia       Quote:   "....."  (Charlie Chaplin)