Is there an effective way to disable root access on linux in an office setting
I'm currently working for SaaS a company and as part of a security audit we were advised to remove all administrative access from all laptops/end-user pc's for a Principle of Least Permissions.
Is there any MDM/management software for Ubuntu that would allow us to remove root-access to ensure we're less vulnerable to malicious software/control what kind of software is installed?
For our Windows/Mac users this was achieved with relative easy, however we have quite a few developers (in fact, almost all) running Ubuntu. The current proposed solution is:
- Running a VM with admin access for dev work
- Having no admin access on the machine (no root/sudo/nothing)
I'm not a fan of this solution because it means more overhead and would require switching to/from the VM each time I want to check my mail (otherwise what's the use). I already proposed to switch away from Ubuntu entirely to Windows but this was not received with much enthusiasm from both devs and management.
Auditors in general audit against a set of specific rules, guidelines or baselines. If you don't produce a reasonable baseline yourself, they will use their own baselines, and then you get requirements like this.
The principle of least privilege (PoLP) refers to an information security concept in which a user is given the minimum levels of access – or permissions – needed to perform his/her job functions.
That means, that if you can explain why root-access is necessary for developers on their own laptop, then you can give them the root access. But you need to explain why it is necessary (and acceptable), and document that, with appropriate signatures.
You may also want to describe what security measures you have taken to minimize the risks. A possible set would be:
- put them on their own network
- firewall-off that network
- any further separation between test, development and production
- an awareness campaign (users only get root after a talk with the Security guy)
things like that.
Running a VM with admin access only moves the problem. You will get the same requirement/discussion of least privileges on the VM as well.