43

Questions related to this in a not specifically academic setting have been asked elsewhere, notably Should developers have administrator permissions on their PC? and Should dev be admin on their computer? My question relates to my job as an academic at a (UK) university.

I moved to using Linux at work so that I did not have to have my computer managed by my university's IT service. This is purely because they are poorly resourced/managed and so addressing small problems takes a very long time. I might, for example, have to wait several weeks for a piece of (free) software to be installed. This imposes unacceptable (to me) delays on my research. They are now changing University policy such that all PCs connected to the network are managed by IT (reasonable), backed-up (reasonable) and local admin privileges are restricted to those who can demonstrate a genuine need for them (reasonable, but I am unwilling to go back to not being able to make progress because of them).

I am confident that one way and another in the end I can persuade them of my need -- but I would like to avoid the delays, meetings, and aggravation this will involve.

What are good, unarguable reasons, that I might need local admin rights. I'm currently thinking 'compiling code written by my co-author' but I might need something more concrete. They will not know enough about my research to know what I might actually need or not.

  • 17
    Linux can be configured to allow the ability install and run software as a unprivileged user (in at least some cases even using a package management system), so just that need is probably not a very strong argument. – dmckee Nov 20 '16 at 22:10
  • 14
    Are you allowed to run virtual machines in which you have admin rights? – CodesInChaos Nov 21 '16 at 9:41
  • 6
    related but not full-answer-worthy: twitter.com/walkingrandomly/status/791559409457631232 twitter poll of academics. 79% of polled HAD admin rights, 16% didn't have admin rights and considered it a problem, only 5% didn't have admin rights and didn't mind. – Reinstate Monica Nov 21 '16 at 15:41
  • 10
    Have you considered just letting them do what they want, and then opening a support request every time you need something done? Just aggressively (but politely) follow up on every request until it gets completed, and complain up the chain of command if it doesn't get done in a timely fashion. If you really need the rights, that's the best way to prove it. – barbecue Nov 22 '16 at 2:47
  • 8
    When I write scientific code to test my theoretical results or to implement a method I am studying, I become, for all intents and purposes, a developer. Therefore all the arguments from the related StackOverflow question come into play, which was overwhelmingly answered with 'yes'. – cfh Nov 22 '16 at 11:49

11 Answers 11

48

So far, I have only come across one reason for needing something close to administrator rights on a fixed department machine: using scientific software.

When you start using a new scientific piece of software, you often have its source code, and need to build it first. Typically, there is no documentation of what exact packages in your Linux distribution are needed (as this changes over time, and there are many Linux distributions as well). So the process is:

  1. Try to build
  2. Identify the cause of error (installing new software, updating the compiler, ...)
  3. Fixing the cause of error (requires administrator rights
  4. Repeat steps 1-3 many times until done.

You can only move towards the respective next issue when one has been resolved. It is unrealistic to assume that you can give an admin a list of required packages upfront,

Without admin rights and an admin reaction time of, say, ~6 hours, this process may easily take a week. With admin rights, the process will be much faster.

BTW: When you start using scientific software professionally, there may be more packages that you need to install (LaTeX, screen, ...), so the process continues.

If you tell the IT people that this is the (unavoidable) process with most scientific software, and you will need to work with ~10 such tools during your PhD, then you should have a good point. On a technical level, there may also be the possibility for "admin light" access, namely by whitelisting your username for "sudo"ing a package installation request. Perhaps that is an option as well in your case.

  • 5
    This is an excellent suggestion -- admin light rights such that I am able to install scientific software would address my key concerns. Although I would still be at their mercy for anything else (6 hours is very optimistic -- my last request took 2 weeks!). – dothyphendot Nov 21 '16 at 11:43
  • 8
    Sorry but none of this requires admin rights on a Linux machine. On OS X, sure. The only conceivable use of admin rights might be to change the default shell so that no default configuration is loaded but that’s strictly optional. – Konrad Rudolph Nov 21 '16 at 18:51
  • 8
    Not sure why this is up-voted so much - as various people have pointed out you DO NOT require admin rights to install software in Linux and in fact it is very bad practice to have admin rights for no reason... I work in IT and people doing stuff like this is the main cause of viruses/ransomware running rampant. Permissions should be the minimum required. – Milney Nov 22 '16 at 11:46
  • 5
    @Milney No, but we need a decent packaging system that allows users to install software, otherwise a simple sudo apt install somesoftware may turn into hours or days of reading the instructions, compiling, missing prerequisites and dependency hell. Can we at least agree on this? Guix, mentioned above, seems promising (but I am not sure how it handles dependency conflicts with the local package manager). Give academics such a packaging system and I am sure no one will ask for root access anymore. – Federico Poloni Nov 23 '16 at 7:21
  • 2
    @Milney The rationale behind this answer is essentially what Federico wrote. You can of course install your own version of gcc/clang locally together with all required libraries. It just takes a long time (dependencies) and when something during the process doesn't work (compilation error messages, etc.), it is terribly difficult to find the culprit, especially since libraries and programs may use build tools that you are not familiar with (e.g., how do you tell Cmake where to find a custom-built library? Lots of documentation to be read to fix this). [...] – DCTLib Nov 23 '16 at 8:45
33

Actually, I don't think the most important thing to convey to the powers that be is that you have a valid reason to have admin rights. More important is to convince them that you will handle the admin rights in a responsible way.

The trick is to convey the latter while ostensibly writing about the former.

Think about it from their point of view. They are tired of distracted professors causing security risks and decided to draw a clear line in the sand.

In your one or two paragraph request, you need to come across very knowledgeable and with excellent judgment. Also indicate you would ask for help if in ANY doubt about anything.

It would be ideal if you could find an ally on the inside to support your request.

  • 4
    I sympathise with their problem, they need to protect both themselves and overconfident users. I can easily imagine were they resourced/managed I might be more willing to trust them to manage my PC for me. I have had such rights, under the previous system (which required me to demonstrate that I knew what I was doing, to waive some rights to technical support, and to take responsibility for things going wrong), for over 10 years. But, the new policy is now much more restrictive, and they are not better resourced. – dothyphendot Nov 21 '16 at 11:40
  • 38
    @Dunk Yeah... You're not an academic, are you? – David Richerby Nov 21 '16 at 21:03
  • 10
    @Dunk - Even in private industry, there are companies where software engineers are not assumed to be idiots and are given admin rights on their computers. Obviously, even in enlightened work environments, if someone is seen to exercise poor judgment, then he is given a shorter leash. – aparente001 Nov 22 '16 at 3:57
  • 6
    @Dunk 'Free software' is not the same as 'freeware'. The definition you quote applies to freeware. It does not apply to free software. Free software is not proprietary. Linux is free software. It is not freeware. The same is true for GIMP, LaTeX, TeX, Python, Chromium, BSD etc. (Not sure about the others listed in the previous comment, though Java certainly can be free.) You are talking about free as in beer. I understood the OP to be primarily talking about free as in freedom. The LaTeX packages I've published are free software, but they are certainly not freeware. – cfr Nov 22 '16 at 15:51
  • 5
    @Dunk You were the one who quoted Wikipedia's definition ;). You asked which part of it didn't apply. As far as I know, that is the generally accepted definition. In any case, if you mean 'freeware' in the broader sense, your claim that freeware is generally a source of trojans and malware is obviously false. If the OP really means 'Windows' when they say 'Linux' and 'freeware' when they say 'free software', then your claim has merit. Otherwise, not. Note that RHEL is freeware according to your definition, even if you pay for it because you can download the code etc. for nothing. – cfr Nov 22 '16 at 16:15
9

The following makes excessive assumptions about what your work entails, but...

  1. Get computing time on an external HPC resource (in the UK that would be Archer or a field specific resource such as DiRAC), as you need compute resource beyond that which your university can provide.
  2. Say to the university that, as HPC systems run on Linux and they update software on their own release cycles, it's necessary for you to have your own Linux-based system that you can update to match so you can effectively develop and maintain the code to run on the HPC system.

This argument is much more convincing if you've already got point 1, or a history of using HPC or similar computing resource, of course.

9

At my institution, anyone in the C.S. department can get admin access under the assumption that we need to develop, compile, and test new software (including assessment of various packages). I just got this access last week, in fact. Support/request from the chairperson helps.

  • Indeed, this was previously our system too! – dothyphendot Nov 21 '16 at 11:46
  • 1
    Normally, you only need sudo access to your package manager in order to be able to develop, except when you develop kernel & drivers stuff. – Dmitry Grigoryev Nov 21 '16 at 13:03
  • 2
    There were several mentions of sudo, but what keeps you from doing sudo su -? They could restrict it to a particular program, but then it would either be not very useful or bypassable (for example sudo gcc -E ... -o /etc/sudoers). With package manager access you can always: remove something, replace the kernel, install something that has install time configuration and allows writing arbitrary files. And installing/compiling programs and libraries in your user directory should not be a problem. – Sebi Nov 22 '16 at 12:18
8

I am an academic at a UK university. What you are requesting is not unusual and others have given good answers. There is however another solution which we have for research computers which is that the users have admin rights on their local research machines and have limited internet access on a different subnet which gives these machines the same access to internet resources as guests but does not give priviledged access to internal university systems. This provides the level of internal network management and control which is necessary these days but gives flexibility for researchers. It does also mean that a researcher who also does teaching/admin may need a separate desktop computer as well as their research computer.

The other issue you have to realise is that admin rights are a privilege not a right in this environment. If they are misused you can expect to lose them. I have known this to happen where researchers have set stupid root passwords on their machines or where research students have downloaded illegal cracked software rather than asking for properly licensed installs.

  • 1
    The situation is currently as you describe, my machine has limited access to shared drives, etc, and I have control over it. I'm happy with this compromise. But, the new policy is much more draconian. – dothyphendot Nov 21 '16 at 13:03
8

Writing from the perspective of an IT professional (and former academic) who worked for a major University creating a managed operating environment to try and stop this thing - there isn't one. There is a faux-administrator access that gets around virtually any legitimate use of real administrator access so that's probably the best you can (should be able to) expect.

The amount of pain to IT support caused by incompetent administration of computers is incalculable. The number of machines they had to deal with that had been compromised by viruses, malware, bootleg software and a whole host of unpleasantness that you can probably imagine that is a consequence of attaching admin level users to minimally filtered and monitored high speed internet connections.

In order for a University to protect itself from criminal proceedings, it has to be able to control the computers attached to its' network. The "good old days" sadly are over and it is no longer acceptable for academic staff to run torrent software committing massive levels of IP violation / theft from a university owned computer.

Your fundamental problem is not that you need Admin rights. What you need is not to be delayed when installing software. So, what that means is you need a better funded IT department. That is what you should be pushing for.

The IT department should have the resources to "package" software quickly. This means preparing it for safe installation and uninstallation along with any dependencies - like Linux package management but centrally administered. Good package management allows for self service installation so that would mean you'd be piggybacking off of the efforts of the whole University - if anyone else requested a piece of software, it would then become available to everyone and if it was free you could self install with a click. If it wasn't free you could provide approval to release the funds and get it installed automatically.

On a more practical note, if you absolutely have to play with admin level privileges - do it in a virtual machine. Preferably on a cloud based server.

Commercial IT is moving heavily in this direction and if my experience is anything to go by the computer science academics are very out of date in this regard and are not preparing their students for the real world. Look at tools like "Docker", "Bitnami" and "Eclipse Che" to see various examples of the sorts of tools that are available to pretty much eliminate the need for bare metal admin access.

EDIT

A few more points.

1) Academics (generally) do not appreciate how proactive you have to be to secure a network. It's poor use of their time to scour CERT looking for reasons to patch stuff so they don't - with unfortunate consequences.

2) If you have admin access, you will be able to cause much more damage. Click on an e-mail link from a non-privileged account and it's no big deal. Click on one as root and your account be sending a phishing e-mail to the entire University address book within half an hour - causing man-weeks of clean-up for the IT department.

3) There really are no real legitimate requirements for full admin access these days that I can think of:-

Compiling software -> Isolated VM

Running old software -> Virtualized bubble (research "App-V" for example)

4) The advantages of a properly managed desktop are not just one-sided. If your IT department gets it right you will be able to:-

  • Log into any machine on campus and access your data (and your data will be regularly backed up and reside on a secure fail-safe infrastructure). No more USB sticks with critical and confidential data on them. No more academics in tears because the only copy of their work was kept on a single external HDD that failed.
  • Have access to that data from a home computer should you need it. Possibly with some caveats (having the right anti-virus installed maybe).
  • Have a LOT of available space if you need it.
  • Therefore if your machine fails you will be up & running less than fifteen minutes after the delivery of the replacement (depending on how many non-standard packages you have installed). Boeing has had this for YEARS. It saves them a fortune.
  • The ability to install (and uninstall) common software without involving IT.
  • Access to temporary (isolated from the internet) VMs in a secure University owned cloud with admin access to do tasks that absolutely need it. You should be able to stand up a virtual PC in less than 5 minutes and then discard it when you're done.
  • This technology can also be used to create virtual teaching labs with just the software you need for the class rather than expecting your IT staff to get 9+ units worth of required software to "play nice" with each other in the two weeks before the first semester starts.
  • Need a long-lived VM to do significant compute over several days/weeks/months? - service request. Possible cost to you if your need is excessive but the cost will be competitive with AWS or MS Azure equivalents.
  • Less stressed IT support because they're not overloaded cleaning up the fallout from the latest phishing scam so response times should be much better. In fact, you should have a published service catalogue from IT detailing what services they offer, how much they cost and how quickly you can expect a response. This is all standard stuff they should have time for if the environment becomes more controlled.

Seriously, this is a positive move. Embrace it, support it and you will be better off.

  • 10
    Push for a better funded IT... and an unicorn for commuting. You'll likely have the same luck. I am administering my own machine, and I have never needed IT's help, freeing their time to deal with the people that need it. Plus, many academic packages are free for academics, so I can download and compile a copy, but the license prohibits its redistribution, so the university wouldn't be able to include it in their repository. – Davidmh Nov 22 '16 at 12:20
  • 3
    -1. Your ideas appear completely out of touch with reality. You talk about "compromised" computers and assume bad faith in everyone using your network, where in reality a machine not owned by the university has absolutely no difference with an average compter connected to an average ISP. ISPs deal with the "completely chaotic out of control" environment 24/7 with no issues whatsoever. The correct action to dealing with insecure computers is to isolate them from the secure network. – March Ho Nov 22 '16 at 14:48
  • 4
    1. How does not having admin rights (or having them only in a VM) prevent me for running torrent software? 2. If a workstation in your network can become an Estonian spam relay, then there is something very wrong with your firewall configuration. – Federico Poloni Nov 22 '16 at 20:23
  • 3
    @mcottle I've been in IT and I've been in academia. Throwing out ignorant statements about who is the "roadblock" is a 100% guaranteed recipe for institutional failure. Believe me when I say that I've dealt with academics throwing hissy fits. But, the function of the research university is to enable research. Research is what pays the bills and keeps everything going, and IT throwing up roadblocks to effective research is never a valid solution, even on the theory that things will be OK once everything is "under control". If the current IT situation does not give you #4, you don't have it. – David Nov 23 '16 at 6:04
  • 3
    @mcottle The reason that universities don't function well is because the people there are stupid and stubborn? You sound like you have very little experience with either university IT or with corporate IT. I'm not sure which. – David Nov 23 '16 at 7:01
4

As a system administrator working in an institute there really is no reason why users should have admin privileges. It is possible for users to request specific privileges in exceptional cases, but this is a whitelist approach and won't give you full admin rights (e.g. users may get the privilege to restart a pre-defined service, but won't get enough permissions to start a privileged shell). If the workstations are under IT management this likely also means that any changes you perform as an admin will be overridden anyway (e.g. when using Puppet or Chef for configuration management).

For the installation of scientific software I recommend GNU Guix, a reproducible, user-controlled functional package manager. We use it at our institute on the HPC cluster and user workstations to enable users to install all sorts of scientific software. To install software with GNU Guix a user does not need admin privileges.

  • 1
    Same caveat I already mentioned elsewhere: macOS (and, I believe, Windows) is still essentially bricked without admin rights. Most things will work (once something like Homebrew is set up) but every once in a while lack of admin rights can be a problem. I know of an institute that doesn’t usually give users admin rights on their Macs and it’s a real nuisance. However, you are spot-on for Linux. – Konrad Rudolph Nov 22 '16 at 12:53
  • @KonradRudolph Windows isn't bricked without admin since XP. Lots of options exist these days. A well administered Active Directory and package management system can do wonders. Apple is more problematic because it is not designed for use in a professionally managed environment (that was a quote from APPLE before you flame me :) Casper helps but I still think there may be issues. If I had my way I'd wipe the lot of them and get them dual booting Win/Linux but then I don't worship at the "Church of Steve" :) – mcottle Nov 22 '16 at 15:43
  • @mcottle In my defence, the the last Windows I have used was XP. :-) I’ve heard other people moan but they may simply have worked on a badly set up system. – Konrad Rudolph Nov 22 '16 at 15:50
3

What bothers me most in this IT policy is the requirement that "all PCs connected to the network are managed by IT". Since you claim to have installed Linux on your computer without the help of IT, I doubt it is managed by university's IT service at all. Since you've had unrestricted admin access to to your machine for some time, there is no reasonable way for the IT to enforce any policy without reinstalling whatever system they are able to manage (even if it's Linux, it has to be installed by them to make sure you cannot get admin rights in spite of their restrictions).

Note that if your IT support is unprofessional enough to simply change your root password, you'll still have admin access to your system via sudo or by setting setuid attribute on commands which need admin rights.

  • 3
    The policy is that they are going to reinstall/reconfigure Linux to ensure that they have the necessary controls. I agree that this is unreasonable! – dothyphendot Nov 21 '16 at 12:58
  • 3
    How does this answer the question? – David Richerby Nov 21 '16 at 21:09
  • @DavidRicherby the implied answer I got from this is "Don't worry about it, they can't enforce the policy" but it definitely could be clearer. – barbecue Nov 22 '16 at 0:59
  • This type of policy is usually enforced by firing those breaking it. – Stig Hemmer Nov 22 '16 at 8:47
  • @StigHemmer I'd expect the machine to be removed from the network in the first instance. – David Richerby Nov 22 '16 at 8:53
2

The best reason for needing admin rights (ran IT for large company for 3 years) is that you have a program that needs to run and be changed often, and this requires admin rights.

What you have outlined in your second paragraph, well it is why we want to keep admin rights from users. I would certainly not tell this to your local school's IT department, as it could cause you to have a harder time in gaining admin rights. The most troublesome part is the free software bit (which many times could have attached trojans or malware), to go along with the fact that you might use your admin rights to turn off your security software.

You are much better off coming up with a specific piece of software that you must be admin to run or make config changes (often). A better way to handle this - and this is up to your local IT's ability - is to set up a VM and have admin access to this VM environment.

For instance when I used to compile a lot, I liked to do so in my old XP VM environment with 512MB allocated. This might take longer but I could do other things while compiling.

As for everything else you said, it doesn't make sense. The risk of working on projects is losing information. Find a way to back things up through drives or online. I don't see how this has anything to do with your IT. Acting like your IT's lack of ability is hurting your research or projects just sounds far fetched.

  • Comments are not for extended discussion; this conversation has been moved to chat. – eykanal Nov 23 '16 at 14:03
0

What are good, unarguable reasons, that I might need local admin rights.

One bulletproof reason for having admin rights is that you develop and test new OS kernels.

Even if they only give you access to modify the boot loader you can get bonus points for writing your own system call that sets the current process ID to root.

-1

Just say that you want to install Linux and that you will waive any requirements for technical support in writing to their superior and to yours, though you hope they might help if the need arises.

  • This looks like you did not read the question. The OP is already running Linux, and wants to respond to a new change in University policy. – Wildcard Nov 7 '18 at 1:05

protected by ff524 Nov 23 '16 at 6:17

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.