Reasons for an academic to need administrator rights on work computer

Question

Questions related to this in a not specifically academic setting have been asked elsewhere, notably Should developers have administrator permissions on their PC? and Should dev be admin on their computer? My question relates to my job as an academic at a (UK) university.

I moved to using Linux at work so that I did not have to have my computer managed by my university's IT service. This is purely because they are poorly resourced/managed and so addressing small problems takes a very long time. I might, for example, have to wait several weeks for a piece of (free) software to be installed. This imposes unacceptable (to me) delays on my research. They are now changing University policy such that all PCs connected to the network are managed by IT (reasonable), backed-up (reasonable) and local admin privileges are restricted to those who can demonstrate a genuine need for them (reasonable, but I am unwilling to go back to not being able to make progress because of them).

I am confident that one way and another in the end I can persuade them of my need -- but I would like to avoid the delays, meetings, and aggravation this will involve.

What are good, unarguable reasons, that I might need local admin rights. I'm currently thinking 'compiling code written by my co-author' but I might need something more concrete. They will not know enough about my research to know what I might actually need or not.

Answer 1

So far, I have only come across one reason for needing something close to administrator rights on a fixed department machine: using scientific software.

When you start using a new scientific piece of software, you often have its source code, and need to build it first. Typically, there is no documentation of what exact packages in your Linux distribution are needed (as this changes over time, and there are many Linux distributions as well). So the process is:

1. Try to build
2. Identify the cause of error (installing new software, updating the compiler, ...)
3. Fixing the cause of error (requires administrator rights
4. Repeat steps 1-3 many times until done.

You can only move towards the respective next issue when one has been resolved. It is unrealistic to assume that you can give an admin a list of required packages upfront,

Without admin rights and an admin reaction time of, say, ~6 hours, this process may easily take a week. With admin rights, the process will be much faster.

BTW: When you start using scientific software professionally, there may be more packages that you need to install (LaTeX, screen, ...), so the process continues.

If you tell the IT people that this is the (unavoidable) process with most scientific software, and you will need to work with ~10 such tools during your PhD, then you should have a good point. On a technical level, there may also be the possibility for "admin light" access, namely by whitelisting your username for "sudo"ing a package installation request. Perhaps that is an option as well in your case.

Answer 2

Actually, I don't think the most important thing to convey to the powers that be is that you have a valid reason to have admin rights. More important is to convince them that you will handle the admin rights in a responsible way.

The trick is to convey the latter while ostensibly writing about the former.

Think about it from their point of view. They are tired of distracted professors causing security risks and decided to draw a clear line in the sand.

In your one or two paragraph request, you need to come across very knowledgeable and with excellent judgment. Also indicate you would ask for help if in ANY doubt about anything.

It would be ideal if you could find an ally on the inside to support your request.

Answer 3

The following makes excessive assumptions about what your work entails, but...

1. Get computing time on an external HPC resource (in the UK that would be Archer or a field specific resource such as DiRAC), as you need compute resource beyond that which your university can provide.
2. Say to the university that, as HPC systems run on Linux and they update software on their own release cycles, it's necessary for you to have your own Linux-based system that you can update to match so you can effectively develop and maintain the code to run on the HPC system.

This argument is much more convincing if you've already got point 1, or a history of using HPC or similar computing resource, of course.

Answer 4

At my institution, anyone in the C.S. department can get admin access under the assumption that we need to develop, compile, and test new software (including assessment of various packages). I just got this access last week, in fact. Support/request from the chairperson helps.

Answer 5

I am an academic at a UK university. What you are requesting is not unusual and others have given good answers. There is however another solution which we have for research computers which is that the users have admin rights on their local research machines and have limited internet access on a different subnet which gives these machines the same access to internet resources as guests but does not give priviledged access to internal university systems. This provides the level of internal network management and control which is necessary these days but gives flexibility for researchers. It does also mean that a researcher who also does teaching/admin may need a separate desktop computer as well as their research computer.

The other issue you have to realise is that admin rights are a privilege not a right in this environment. If they are misused you can expect to lose them. I have known this to happen where researchers have set stupid root passwords on their machines or where research students have downloaded illegal cracked software rather than asking for properly licensed installs.

Answer 6

Writing from the perspective of an IT professional (and former academic) who worked for a major University creating a managed operating environment to try and stop this thing - there isn't one. There is a faux-administrator access that gets around virtually any legitimate use of real administrator access so that's probably the best you can (should be able to) expect.

The amount of pain to IT support caused by incompetent administration of computers is incalculable. The number of machines they had to deal with that had been compromised by viruses, malware, bootleg software and a whole host of unpleasantness that you can probably imagine that is a consequence of attaching admin level users to minimally filtered and monitored high speed internet connections.

In order for a University to protect itself from criminal proceedings, it has to be able to control the computers attached to its' network. The "good old days" sadly are over and it is no longer acceptable for academic staff to run torrent software committing massive levels of IP violation / theft from a university owned computer.

Your fundamental problem is not that you need Admin rights. What you need is not to be delayed when installing software. So, what that means is you need a better funded IT department. That is what you should be pushing for.

The IT department should have the resources to "package" software quickly. This means preparing it for safe installation and uninstallation along with any dependencies - like Linux package management but centrally administered. Good package management allows for self service installation so that would mean you'd be piggybacking off of the efforts of the whole University - if anyone else requested a piece of software, it would then become available to everyone and if it was free you could self install with a click. If it wasn't free you could provide approval to release the funds and get it installed automatically.

On a more practical note, if you absolutely have to play with admin level privileges - do it in a virtual machine. Preferably on a cloud based server.

Commercial IT is moving heavily in this direction and if my experience is anything to go by the computer science academics are very out of date in this regard and are not preparing their students for the real world. Look at tools like "Docker", "Bitnami" and "Eclipse Che" to see various examples of the sorts of tools that are available to pretty much eliminate the need for bare metal admin access.

EDIT

A few more points.

1) Academics (generally) do not appreciate how proactive you have to be to secure a network. It's poor use of their time to scour CERT looking for reasons to patch stuff so they don't - with unfortunate consequences.

2) If you have admin access, you will be able to cause much more damage. Click on an e-mail link from a non-privileged account and it's no big deal. Click on one as root and your account be sending a phishing e-mail to the entire University address book within half an hour - causing man-weeks of clean-up for the IT department.

3) There really are no real legitimate requirements for full admin access these days that I can think of:-

Compiling software -> Isolated VM

Running old software -> Virtualized bubble (research "App-V" for example)

4) The advantages of a properly managed desktop are not just one-sided. If your IT department gets it right you will be able to:-

• Log into any machine on campus and access your data (and your data will be regularly backed up and reside on a secure fail-safe infrastructure). No more USB sticks with critical and confidential data on them. No more academics in tears because the only copy of their work was kept on a single external HDD that failed.
• Have access to that data from a home computer should you need it. Possibly with some caveats (having the right anti-virus installed maybe).
• Have a LOT of available space if you need it.
• Therefore if your machine fails you will be up & running less than fifteen minutes after the delivery of the replacement (depending on how many non-standard packages you have installed). Boeing has had this for YEARS. It saves them a fortune.
• The ability to install (and uninstall) common software without involving IT.
• Access to temporary (isolated from the internet) VMs in a secure University owned cloud with admin access to do tasks that absolutely need it. You should be able to stand up a virtual PC in less than 5 minutes and then discard it when you're done.
• This technology can also be used to create virtual teaching labs with just the software you need for the class rather than expecting your IT staff to get 9+ units worth of required software to "play nice" with each other in the two weeks before the first semester starts.
• Need a long-lived VM to do significant compute over several days/weeks/months? - service request. Possible cost to you if your need is excessive but the cost will be competitive with AWS or MS Azure equivalents.
• Less stressed IT support because they're not overloaded cleaning up the fallout from the latest phishing scam so response times should be much better. In fact, you should have a published service catalogue from IT detailing what services they offer, how much they cost and how quickly you can expect a response. This is all standard stuff they should have time for if the environment becomes more controlled.

Seriously, this is a positive move. Embrace it, support it and you will be better off.

Answer 7

What bothers me most in this IT policy is the requirement that "all PCs connected to the network are managed by IT". Since you claim to have installed Linux on your computer without the help of IT, I doubt it is managed by university's IT service at all. Since you've had unrestricted admin access to to your machine for some time, there is no reasonable way for the IT to enforce any policy without reinstalling whatever system they are able to manage (even if it's Linux, it has to be installed by them to make sure you cannot get admin rights in spite of their restrictions).

Note that if your IT support is unprofessional enough to simply change your root password, you'll still have admin access to your system via sudo or by setting setuid attribute on commands which need admin rights.

Answer 8

As a system administrator working in an institute there really is no reason why users should have admin privileges. It is possible for users to request specific privileges in exceptional cases, but this is a whitelist approach and won't give you full admin rights (e.g. users may get the privilege to restart a pre-defined service, but won't get enough permissions to start a privileged shell). If the workstations are under IT management this likely also means that any changes you perform as an admin will be overridden anyway (e.g. when using Puppet or Chef for configuration management).

For the installation of scientific software I recommend GNU Guix, a reproducible, user-controlled functional package manager. We use it at our institute on the HPC cluster and user workstations to enable users to install all sorts of scientific software. To install software with GNU Guix a user does not need admin privileges.

Answer 9

The best reason for needing admin rights (ran IT for large company for 3 years) is that you have a program that needs to run and be changed often, and this requires admin rights.

What you have outlined in your second paragraph, well it is why we want to keep admin rights from users. I would certainly not tell this to your local school's IT department, as it could cause you to have a harder time in gaining admin rights. The most troublesome part is the free software bit (which many times could have attached trojans or malware), to go along with the fact that you might use your admin rights to turn off your security software.

You are much better off coming up with a specific piece of software that you must be admin to run or make config changes (often). A better way to handle this - and this is up to your local IT's ability - is to set up a VM and have admin access to this VM environment.

For instance when I used to compile a lot, I liked to do so in my old XP VM environment with 512MB allocated. This might take longer but I could do other things while compiling.

As for everything else you said, it doesn't make sense. The risk of working on projects is losing information. Find a way to back things up through drives or online. I don't see how this has anything to do with your IT. Acting like your IT's lack of ability is hurting your research or projects just sounds far fetched.

Answer 10

What are good, unarguable reasons, that I might need local admin rights.

One bulletproof reason for having admin rights is that you develop and test new OS kernels.

Even if they only give you access to modify the boot loader you can get bonus points for writing your own system call that sets the current process ID to root.

Answer 11

Just say that you want to install Linux and that you will waive any requirements for technical support in writing to their superior and to yours, though you hope they might help if the need arises.