Desktop Linux Sliding in Under the Radar? 742
Paul Johnson asks: "This article at ComputerWorld describes a sysadmin's discovery that many people in his company are installing Linux on their desktops without consulting IT. The writer is concerned with the security implications, but there is a wider issue. At present the 'official' penetration of Linux into the desktop market is something around 1%. The writer of this article doesn't give figures, but it sounds like he may have stumbled on several times that percentage of desktop Linux installations. If so then this is an important trend. Linux got its foot in the datacentre door in exactly the same way a few years ago, with unofficial installations doing odd server jobs.
If you are a sysadmin, in an organization that runs Windows on the desktop, have you stumbled on many unofficial Linux installations?"
Not exactly ... (Score:5, Funny)
I tripped over my mail server last week. Does that count?
Re:Not exactly ... (Score:5, Informative)
I got about 4 or 5 of the Unx admins and a good number of the DBS'a doing this too.
In small shops - we had 6 Linux desktops running at the Multi-Media Developer I worked at in '94. XFree on ATI Mach32, anyone?
Re:Not exactly ... (Score:5, Insightful)
I used to agree with giving employees freedom to run whatever OS they are comfortable with, but you have to keep into consideration the Information Security view on things. A *nix OS with a few network tools installed, gcc, and some skills can lead to a lot of problems for the company.
Think that's silly? Think again. Think about doing technical support for bitter and unthankful lusers. Your boss is an asshole. You make $23k/year and missed your shot as an [insert engineer/developer position here] before the bubble popped. No hope for a future with the company since they have a revolving door system in place where 3/4 of the low-level staff is on temporary contracts that expire every 90-300 days.. I know, it's sad and I've seen a lot of talent from people stuck in these types of jobs and feel terrible for them. But, this is a common person in technical call centers. I've seen enough from that single profile to type pages, but I'll stop and save it for another post.
Do you trust this employee enough to let him run FreeBSD? You want him having direct access to the 'net without a proxy? I doubt it, especially not after that email where he asked questions about what type of traffic you monitor and how you do audits. What if he's okay but his box ended up getting owned because he downloaded bad BitchX source? That would mean another three day stint of no sleep doing emergency penetration tests, mirroring HD images, finding the exploits, sitting in meetings and explaining what all was affected hoping you didn't miss something critical. That's the tip of the ice berg when it comes to what happens when your office gets owned. Even if workstations are usable, every workstation on the local subnet and server they have ports open to via the firewall have to be investigated. This brings productivity for the money-making sides of the company to a crawl while sysadmins and security folks work to get things safe again. Somewhere around noon, the guy from Public Relations will likely be on the phone wanting to know what to tell CNN when he calls them back. Likely, there will be a news source online with details of how the exploit took place, but completely wrong and now the public and shareholders are going to wonder if credit card numbers were stolen, your ability to properly maintain infrastructure, etc. Then your stock price falls $2/share. That's potential millions depending on how big your company is.
Sorry to ramble, I just wanted to stress the importance of IT policy and the headaches that can happen when the policy is too lax. I'm very pro-Linux/BSD, but not in an enviroment where it's not needed (All those workstations came with an OS you paid for anyway). I also think this treatment of unapproved OS's is very common due to thoughts and situations like the one above.
My stories are actual events portrayed by actors.
Re:Not exactly ... (Score:3, Funny)
But the point is that no one knows it is running linux. The funny thing is that when I set it up I named it 'Joe' and then I
Re:Not exactly ... (Score:5, Insightful)
I don't know about your company, but at my school (I was resident Geek), we set it up so that the DHCP server would automatically set the proxy up as a gateway. We never had any problem about people accessing the internet without going through a proxy.
And aren't the chances actually better of getting some form of backdoor greater for windows? Picking them up via email, bad downloads, even browser security flaws.
I see where having an unauthorized anything running could be a problem, but just linux in general, no, danger isn't in the software as much as it is in the hands of the user.
Re:Not exactly ... (Score:5, Insightful)
In my case (I'm a scientist) I would be seriously inconvenienced if some pointy-headed bureaucratic fool came along and overwrote my Linux partitions with Windows, and my immediate reaction would be to take it up with his boss.
You seem to be operating on the premise that all staff are luddites, vandals or criminals and not to be trusted. I would have thought that, far from losing sleep over this, you should be pleased that this is one person who is not going to be passing out viruses via Lookout Express. In any base, as long as you implement sensible policies (firewalling, quotas or whatever you need to do) there is no reason why your network should not operate transparently without applying unnecessary restrictions.
Re:Not exactly ... (Score:5, Insightful)
Also, I was not trying to give a full IS proceedure, just a quick run of some thoughts of what I have experienced in the past decade.
For starters:
Linux, MacOS, etc is not 'sub-optimal', if your corporation purchased copies of Windows with their workstations, it seems like an even larger disregard for cashflow to not utilize what they paid for. Your scientific and my engineering minds think 'Well, I get more done in Linux', of course we do, but when you sit in with a Loss Prevention group the removed/unused copies of software are considered a total loss.
Your situation is what would be considered a special case by an IT staff. You are a scientist. Silly goose, you will probably need all kinds of things a typical employee will not need. Think about the percentage of scientists versus customer service reps and support people in call centers. Think of the costs associated with each one of these people anually versus what you cost. It's a big difference.
You speak at the end about trust and the suggestion that a network operate transparently without many restrictions. You have to understand that most companies are not in the ISP business for their employees. If you sit down in front of a computer in an office, it's their network, their assets, their butt on the line, their bandwidth costs, etc.
For example, I have worked in a group who's new office was suffering terribly. About a 1400 user network, but the bandwidth leaving the building was always pegged. Upon watching traffic for a few days, it appeared that a major portion was porn and streaming media traffic. We implemented a filter file for the proxy and traffic went from ~97% down to ~30% utilization. This sort of thing is very cost effective and saves people from themselves (female employee walks up on porn mongering male, female complains, male goes unpunished, female cooks up discrimination suit, etc -- just preventative medicine, not a cure for a likely issue in the future).
I guess those who are knocking my tales have never been exposed to a real IT group before. Either that, or they are prepared to lose their jobs someday due to a lack of enforcement or policy that matches your typical fortune 500 company. The suits will not have much pitty for your balls to give excess freedom to employees with their investor-purchased resources.
The downfall of your average geek is the inability to ever see things from an executive, bean counter, or investor's point of view. Threats are real, liability is real, the end result of your investments are real. The joy of an office behind a very trusting packet filter is short lived and a flagerant disregard for company assets, especially if the company is publically held. Your investors are well within their power to take you to court and sue you for every dime you have if there is big enough loss associated with an act that was easily prevented. We never know the limitations of these types of suits because they are civil and not criminal. In a civil suit, you never know if you are going to be made an example. For instance, the massive settlements on people burning themselves with McDonalds coffee. You just don't know what's going to happen. At least with a criminal case, there are boundries clearly defined by law.
You go back to being a scientist and I'll go back to saving people like you from yourselves with your lack of understanding regarding the need for real security policy. I promise I won't pick apart or call FUD when you speak of something technical regarding your line of work... That is, if you don't tell me ficticous realities about how e
Re:Not exactly ... (Score:5, Insightful)
First a minor quibble--you say:
if your corporation purchased copies of Windows with their workstations, it seems like an even larger disregard for cashflow to not utilize what they paid for. Your scientific and my engineering minds think 'Well, I get more done in Linux', of course we do, but when you sit in with a Loss Prevention group the removed/unused copies of software are considered a total loss.
If a worker is more productive in a differennt OS or Office Suite or whatever, then the monetary cost of that unused software is insignificant. Not to mention that the company shoulnd't be buying software unless it will be used.
The bigger problem with your entire post and attitude toward users is best seen here:
People need to quit thinking they have rights to anything in an office. You do what they say or find work elsewhere. There's a big job market out there right now, lots of options, right?
I see the smiley, so I'm hoping this is mostly a joke, but if a company harbors contempt for it's employees, it is doomed. If the option is "my way or the highway", the good employees will eventually choose the highway, regardless of the economy. All you will have left will be compliant losers who don't think for themselves, managed by control freaks who have to do all the thinking for them, deciding which color pen to use.
Or which OS.
Re:Not exactly ... (Score:5, Informative)
You should buy something you want to use.
Using something simply because you bought it is moronic.
The waste happens on the purchasing side, not the usage side.
This is not a 'geek' view, this is a good economist/businessperson's view, and for anyone who disagrees with it, here is a good example.
You're stuck on a desert island. You knew you would be stuck here. TO prepare for being stuck here, you bought some cyanide-based glue (i.e. superglue). Your major problem is that there is no food on the island. Do you
1) Eat the cyanide-based glue
2) Don't eat the cyanide-based glue
The "Well, it would be going to waste if I don't eat it" argument obviously doesn't work here. If you don't get the right tool for the job, you shouldn't be forced to use it-- The damage is already done, no need to exacerbate it.
Re:Not exactly ... (Score:5, Interesting)
Re:Not exactly ... (Score:5, Interesting)
I guess my point is that it is not so much what os a person runs as it is the IT policies and how well they're enforced. Keep up with security patches, don't install untrusted software, good password policy, etc. These things aren't unique to any particular desktop OS and any user could potentially violate them. However, any user that depends on their system for everyday tasks isn't going to intentionally munge it up since they lose the use of it while you may be inconvenienced with rebuilding it. There is always the danger of the 'malicious insider' and we risk it every summer with an influx of student help that always includes some idiot that will try 'bad things'. Deal with them swiftly and harshly and make sure everyone knows about it and you can keep it to a minimum, but you can never eliminate the risks completely.
Re:Not exactly ... (Score:5, Insightful)
You've got to be kidding (Score:5, Insightful)
2) If you sieze machine and reimage them to fit with some policy you're following, your ass would be heading out of town from mass user complaints at any company I've been at. You are IT. You are present to help workers get their damn work done, not to push some random personal agenda. If you wipe an entire system and kill that employee's work, you are a serious impediment to getting work done. I simply am amazed at the total lack of regard for the employee, and lack of perspective you've displayed. You could disconnect the thing from the network. You could ask the user to move his files to another machine so that you can reformat it, though I think you're already pushing the limits. But when you simply grab a machine and reformat it, you're in a position where you are a liability to your company. When the developer tells his boss that IT wiped out his work, his boss tells his boss, and his boss tells his VP, I guarantee that your boss will not cover for you.
You want him having direct access to the 'net without a proxy?
WTF does this have to do with what OS you're running?
I doubt it, especially not after that email where he asked questions about what type of traffic you monitor and how you do audits.
This is ridiculously paranoid. I've seen the occasional IT type who considers the users he is supporting his enemies, but this is beyond belief.
What if he's okay but his box ended up getting owned because he downloaded bad BitchX source?
What if the same damn thing happened because he downloaded a Word file to his Windows box? Which of the two happens in far greater numbers?
That would mean another three day stint of no sleep doing emergency penetration tests, mirroring HD images, finding the exploits, sitting in meetings and explaining what all was affected hoping you didn't miss something critical.
You've worked in an 8,000 unit shop and you honestly believe you have zero penetrations? And your setup is such that you need to spend three days and nights mirroring HD images *after* an attack?
This brings productivity for the money-making sides of the company to a crawl while sysadmins and security folks work to get things safe again
And again, WTF does the OS have to do with this?
Likely, there will be a news source online with details of how the exploit took place, but completely wrong and now the public and shareholders are going to wonder if credit card numbers were stolen, your ability to properly maintain infrastructure, etc. Then your stock price falls $2/share.
Ridiculous. This is a theoretically possible but completely impractical story of what might happen in an attack.
Sorry to ramble, I just wanted to stress the importance of IT policy and the headaches that can happen when the policy is too lax.
Amazing. God, I'm glad the IT people that support me have different views.
(All those workstations came with an OS you paid for anyway).
The infamous sunk cost fallacy. Which they teach you to avoid in Business 101.
I also think this treatment of unapproved OS's is very common due to thoughts and situations like the one above.
It's not. That kind of behavior from IT would generate serious user complaints where I work. Matter of fact, IT is trying to quickly adapt to support people that want to use Linux here, and has compiled resources for them. That's what I consider doing a good, solid job. Helping the users instead of attacking them.
Re:You've got to be kidding (Score:4, Interesting)
You are IT. You are present to help workers get their damn work done, not to push some random personal agenda. If you wipe an entire system and kill that employee's work, you are a serious impediment to getting work done
In most companies, the standard OS is hardly a "personal agenda" - and the worker that installs a new OS on his/her computer without authorization is hardly "getting work done".
Most large companies I know don't allow you to keep your work on your local machine, as it makes all kinds of problems for backups, upgrades, and hardware trouble. Instead employees save all of their work to a central fileserver, which gets backed up on a regular basis. Re-imaging a machine is not a big deal. Even the place I work now (total of 20 employees) does this.
WTF does the OS have to do with this?
If the sysadmins don't know Linux, then they won't be able to fix the breakin.
I only wish! (Score:5, Funny)
Is the sysadmin sure he wasn't dreaming?
Re: _A&T Manual ;-) (Score:5, Insightful)
Re:I only wish! (Score:5, Insightful)
Actually in all honesty I wouldn't want people installing Linux on their own anyway. All users with admin priveleges? I don't know what kind of heaven you're going to, but count me out! =P
Re:I only wish! (Score:5, Funny)
Re:Green Grass. (Score:5, Funny)
But you don't because you're an unemployed has been MSCE. haha
Re:Green Grass. (Score:4, Funny)
I can't spell dinasaur either.
IT headaches (Score:5, Insightful)
This could make the case for desktop Linux look worse, if people are not securing their dektops and/or keeping up with security updates.
Re:IT headaches (Score:3, Insightful)
and i highly doubt they were "unsecured", if these people went through the trouble of installing linux on a work machine they probably have moderate clue.
and im not going to point out that no matter how "secure" your personal workstations are, that once a cracker penetrates that far into your network your screwed.
this guy sounds like he is getting overly paraniod about something he more than likely doesnt understand.
Ignoring the standard MS shot... (Score:5, Informative)
Re:Ignoring the standard MS shot... (Score:4, Interesting)
i have a local gentoo build server with 2 python scripts, and some cron jobs my systems are updated daily on my home network (14 machines. varying from athlons, to mips, to alpha) (not running gentoo on the mips, that runs irix [octane])
Re:Ignoring the standard MS shot... (Score:4, Insightful)
Re:Ignoring the standard MS shot... (Score:3, Interesting)
Not foolproof, but better than what most people have configured today.
When they connect that second device to their stealth hub or switch, your switch will cut them off (Seeing a second connect
Re:Ignoring the standard MS shot... (Score:3, Insightful)
Really? How?
Re:IT headaches (Score:4, Insightful)
but a standard desktop install of 9 is one HELL of alot more secure by default than any windows version i have seen.
NOTE: desktop implies no server services.
Re:IT headaches (Score:3, Insightful)
I'm talking about desktop PC's. If you're talking about something else, then it's a different ball game.
Re:IT headaches (Score:5, Interesting)
I work for a company that was heavily Unix (and X-terms) until the LAN somehow became all MS PCs. Now people and projects are insisting on replacing not only MS but Sun and SGI stuff with Linux. We are meeting heavy resistance from IS.
They are claiming that it costs more to administer a Linux box, even though we've been in meetings and showed that it wasn't true, based on recent experience. They refuse to give even knowledgeable users superuser privileges on their own machines, although Windows users can install anything or delete everything on their boxes at will.
To me it appears that some of the people in IS are afraid of being made less powerful, less needed, and less relied upon.
Re:IT headaches (Score:5, Insightful)
Yeah, telling your boss no is such a great way to keep your job. The conversation would go like this.
Boss: "I hear that this Linux thing is saving other companies millions of dollars a year. Let's do a test pilot."
You: "No."
Boss: "OoooooKay... Why not?"
You: "We don't know anything about Linux in the entire IT department."
Boss: "But from everything I am reading it is the next BIG THING [TM]"
You: "We don't know anything. And even though I don't know anything, I am guessing that it costs more to install, train and hire for it."
Boss: "Isn't that what a pilot program would tell us? I tell you what. Hire someone who knows Linux and have them perform a pilot."
You: "No."
Boss: "Look, I am getting a little tired of this. Do what I say."
You: "No."
Boss: "You're fired."
You: "Booo Hoooo!"
>> None of us know Linux very well, unfortunately.
You don't know Linux? Is your head buried in the sand? Haven't you been hearing more and more and more about Linux over the past 5 years? Do you have so little motivation that you can't download a free iso image from the internet, burn it to a blank CDROM and then install Linux on an old Pentium computer you have just laying around?
>>It would cost a fortune in training and hiring as well as the labor involved changing everyone over.
Actually, the payback for switching over to Linux is immediate and begins paying back the first year, if Linux will work for you at all. Do a pilot program and see if it will work for your company. At the very least, even if you keep using windows look at switching the non power users over to open office.
>> Besides, with our Dell account we basically get the OS for free when we buy PC's.
Oh, you pay.
Total FUD, par for the Computerworld course. (Score:4, Interesting)
The weaknesses from the rogue installs ...come from the installation of third-party applications and utilities, which can leave a desktop or server vulnerable to attack if set up incorrectly.
Huh? What total Microsoft brain washing! What is a "third party application" in the free software world? This dude has his head shoved so deep into the M$ world that he confuses all the crap and spyware that accumulates on windoze boxes and runs as root with free software. I don't know how he's transfered his complete lack of control over Windoze onto software that works. I don't get it.
He goes on, after mentioning that he might be man enough to run Red Hat. He thinks it could do his company good to replace the hideous pile of Word Docs that is their QA tool because it sucks to have to do a "word search" to find information in the 300 reporst/year they generate. So true, just putting those things on a Samba server so you can use grep and find would be really helpful. Imagine how nice his life would be with a nice little mySQL/PHP webform for entry and search instead of a Word template. Progress, forge on brave man!
But, oh no, he shrinks from the fear of vulnerability:
For example, there always seem to be vulnerabilities associated with programs such as file transfer protocol, sendmail and Apache. And other open-source software is vulnerable, especially when the developer hasn't written the program with security in mind.
Poop. Plain and simple poop. Sendmail handles most email. Apache handles most web sites. Who needs ftp when you've got ssh? Well, anonymous ftp is a nice way to share big piles of files and programs like proftp are plenty secure. This is total shit to scare people who don't know what file tranfer protocal is, but like the ease of windoze file sharing. It's ignorant if not intentionally misleading. This line says volumes:
We can't eliminate Linux
No, but some fools wish they could. Other people everywhere are learning all the good things free software can do for them.
Anyone who's worried about security should use Debian's stable distribution. Not only is it all field tested, upgrades can be applied everyday from http://security.debian.org via shell script. Unlike the windows world, these updates install easily and don't break other "third-party" applications.
You say:
This could make the case for desktop Linux look worse, if people are not securing their dektops and/or keeping up with security updates.
That seems to be the intent of the article. Fortunately, only the very ignorant will pay attention to such nonsense and it can easily be deflated. Microsoft is going to have to try much harder than this to keep people away from superior software. Then again, I'm not sure how they can do that. The thing that makes the best case against the Windows desktop is it's record. That now including the author's laborious treck around his company caused by yet another Windows failure. There is not software anywhere with such bad performance.
I'm not a sysadmin (Score:5, Informative)
Re:I'm not a sysadmin (Score:5, Funny)
the key was to install cde and tcsh and say it was solaris x86 (which he disapproved of too.. but less). since he never actually used the machines, this was easy.
Re:ARGHGHG!! There's no such word as "boxen"!!! (Score:3, Informative)
I thought it was in analogy with ox/oxen (which comes from Old English, so in the same family as German). It's easier to pronounce -xen than -xes endings, so rather a shame it's not in more general use.
Undercover LINUX (Score:5, Interesting)
Re:Undercover LINUX (Score:5, Insightful)
Ok, I'm confused here. What exactly is extreme about limiting access to known MAC addresses? Any sprawling network where access to the backbone (i.e. wallplates) can't be controlled should do this. It's just common sense.
As for not allowing anyone on without them telling you what they have, how do you make sure they keep updating? Was it fine for people with WinXP boxen to join the network when XP was first released? Being "up to date on patches on 10/07/02" is great, but utterly meaningless if no patches have been installed since then. Having a required set of patches is nice, but having a good security policy is far better.
Of course, I've always wondered about college networks, since they seem to prefer sending nastygrams or denying access to users, rather than prevent users from doing those things. Want to stop shared folders, file sharing, worms?, set the switches to only allow traffic to pass completely through the switch, not between ports on the switch.
Besides, the average user has no need to be accessible from any other machine, and especially not from outside the local network. Use NAT, separate users from each other, and be done with it. If a user gets a virus/trojan/worm, f@*k-em, at least it won't spread through the network.
Unofficial installations (Score:5, Interesting)
desktop installations. While I was pro alternatives to Microsoft, there was the concern about security - e.g. open e-mail relays, unpatched servers. The company ended up with a policy of permitting Linux on the desktop, but not supporting it. If you had an application issue - you were on your own. The only users that ran it had a clue and we didn't run into issues. Being a research environment, Linux ended up replacing SGI systems as the scientific workstation standard.
Nope, not here (Score:4, Interesting)
Re:Nope, not here (Score:3, Funny)
That's a good thing. I'd hate to have my nurse worrying about incompatiblities with her Wireless NIC and her kernel.
Or my surgeon trying to get First Post on a Slashdot story during my operation!
So thanks for making their job easier and my hospital stays safer. Keep those systems up!
~Z
Re:Nope, not here (Score:3, Funny)
I honestly believe that most of the trolls on slashdot are hospital admin people. What the hell else do they do all day?
Davak
Don't reinstall - boot linux from another disk (Score:5, Interesting)
I DO, however, frequently boot my machine with knoppix [knopper.net]. Most corporate IT environments prevent users from installing their own software - but Knoppix has pretty much every app I need. I sacrifice local file storage and some embedded data like PIM stuff, but its just more comfortable and doesn't raise the ire of the lesser IT geeks.
Re:Don't reinstall - boot linux from another disk (Score:5, Interesting)
The question is printing.
Re:Don't reinstall - boot linux from another disk (Score:4, Informative)
Then, no matter where you go, any machine you can get your hands on your machine.
Does this count? (Score:5, Interesting)
FreeBSD 4.7, autostart XFree86,
full-screen RDesktop to central Win2k Terminal Servers.
User's still think they have a windows
box(windows splash screen on boot).
Does this count?
Re:Does this count? (Score:3, Interesting)
Just curious, I did a big NT 4 terminal server install once and it was one of the more challenging times in my life. Hard, it was, and long. Win2k is supposed to be much better, but is it really worthy (stable, etc.) of a thin client environment?
Re:Does this count? (Score:4, Informative)
Re:Does this count? (Score:3)
Not a problem (Score:4, Funny)
Nope Not at all (Score:5, Insightful)
In truth beyond the server farms ive worked with at said companies the only person possessing any *nix varient has been myself (including mac os X...) While i can see this as being an occasional happening in dorkier companies... even then i find it not very likely.
mainly because buisness use predominataly revolves around outlook exchange's shared meetings and various other stupid stuff.... in addition to the baseline ease of use (overall managerialy) network administration of an all windows environment.
I would NEVER support a linux desktop distro amongst my users.... MAC OS X ... yes.... but not Linux for any reason on gods green earth... can you say nightmare? I love Linux.... but it just is NOWHERE near as streamlined as windows or macintosh... especialy from a support stance.
My personal feelings are *nix for network devices.... Windows server/client for data sharing email and so on.... and Mac os X for end users who are more inclined towards media production (basicly people who arent finance/sales).
This setup puts the *nix boxes in my realm... and id be greatfull that no unwitting user *accidently* installs another DHCP, DNS, SMTP, etc... server on my network. Id also be thankfull not to be asked how to make packages work correctly between KDE, gnome, X, or whatever else joe moron decides to use.... or how to fix their freakin window manager because KDE offers 5 different programs just to change the layout/widgets.... no thank you.
Of course this poster assumes that the people who do so, do so knowing people like myself wont support them... and more than likely will be highly un-happy with their network being potentialy compromised...
not trying to spread FUD.... but ill wait for a tighter distro before i promote *nix on the desktop.... only one so far (with flying colors) is OSX.
Re:Nope Not at all (Score:5, Insightful)
firstly you wouldnt have to worry about them installing a rogue DHCP server if you didnt give them root. As a matter of fact dont even install KDE if you dont need it. you really must have no experience with modern desktop linux installs, otherwise you would have known that: "Id also be thankfull not to be asked how to make packages work correctly between KDE, gnome, X, or whatever else joe moron decides to use" is rather retarded since most apps work fine nowadays, Redhat has a unified desktop which makes the "visual" differance between kde and gnome moot, and redhat would support any other issues you have if you bought a support contract. same as with any other OS.
as for streamlined management well you could simply run a local up2date server with cronjobs as neccasary, and run ssh locally on the clients so that when (and this will be very rare) there is an issue you can just ssh into the box and fix it.
i personally work at an outsourcing company, 3500 employees and we have about a 20% linux desktop install, growing slowly. why ? ease of administration. you have a policy that states what IT supports (evolution, mozilla, gaim etc) and whenever somebody asks for help with something not supported you point and say "No". And the best part is you dont have to have someone running around constantly re-imaging all of those windows boxes....
Bull cocky times five (Score:3, Interesting)
Dont install KDE? For a user? are you expecting them to use X? or maybe the CLI? or should i dictate them to simply use my preferred manager? Once again... poster said these would be boxes i didnt set up.... so theyd probably install whatever they wanted. Support contracts are certainly cool... but even still.
Re:Bull cocky times five (Score:3, Insightful)
and my setting a "No" policy on unsupported software is different from a policy of "acceptable" software how ? someone is still saying no, i am not a hard ass, but i also have no reason to get some half shit mail client to work when evolution already does so.
My entire post was based on the thought of "rather than being a flaming asshole perhaps you should
"Insecure" Linux, Cygwin and RedHat (Score:5, Informative)
Now I know more and have played enough that I disable everything except what I need, make sure it's secure and then put up a firewall just to be sure. But heck, just the other day I realized I hadn't apt-get update'd and apt-get upgrade'd in a couple of months. Oops. I also had weak passwords until about a month ago.
I'm in a non-tech company, and the Linux penetration is well below 1%. Only one desktop--a dual-boot laptop--as far as I know (except when I boot up KNOPPIX), but I have three rouge servers of my own. (Squid, Nessus, nmap and Snort are my friends.)
I also have two Cygwin installs, but they're my workstations, not user PCs. Anyone seeing those on desktops yet?
In this article the guy chose RedHat. If you don't care for commercial support, why would you choose RedHat over Debian or Slackware? Especially if security is a concern.
Live Linux CD's (Score:3, Informative)
As a ardernt Linux user, I would just change the BIOS settings to boot from CD first, and pop in Knoppix, or leave the CD-ROM tray empty when I wanted to use windows. No one in IT would need to know what I was upto.
New York City 911 EMS: When you absolutley, positivley cannot call a cab for your toothache
I work for M$ (Score:5, Funny)
I'm under the radar (Score:4, Interesting)
I've been here 3 years. Last year and the year previous to that, all of the IT web pages said that the only officially supported OSes were Windows and MacOS, with a stern implication that that was it (and don't you think about using anything else, grrr!). This year, they've acknowledged that Linux exists, and are giving some support for it. The IT folks are at least aware of Linux now, a change for the better.
Why is this happening? Because there are a few researchers (including me) who have installed Linux on their desktop/analysis machines, and are doing their own system administration. But, these users still need to fit into the global IT picture, for example, communicating with the email servers. As we have migrated from one email system to another recently, the IT folk have visited every single user (no, not kidding) to move their email system over. The fact that I was running Linux was not only no big deal, but they even correctly guessed which mail client I was using, given that I was running Linux. We are, slowly, winning.
From a security viewpoint, installing MSFT (Score:3, Interesting)
Why this is good... (Score:3, Funny)
> he may have stumbled on several times that percentage of desktop Linux installations.
If this is true it would be really great for us at Slashdot because then we could brag about a higher Linux desktop market share to our girlfriends...
No wait, that can't be right...
Well anyway, he said "Penetration". That's gotta be good, right?
It probably doesn't count, but (Score:3, Interesting)
As part of my job I set up the office G4 (OS X...which they thought was Linux... probably because of Smb) for training... I am in charge of Apple desktop support for our largest client in the area, an HP 9000 D class for my support of the 9000's in the data center (24/7 on-call), a Windows 2000 AS box for training (Citrix Metaframe XP, etc.) and the box I interface it all with... my Powerbook Pismo. I was told to shutdown and remove these from the network... they have a point about security holes and unauthorized access points...but I kind of chuckle because their infrastructure is very poorly built and my machines are 10 x as secure as theirs (case in point I run only SSHd for the most part and lock down everything)
They decided to send us a switch and give us an external IP... (IP only after bitching that a lab environment is useless without an internet connection) which is fine except we can't use the local printers... so instead I built a NetBSD firewall and put everything us techs use behind it and then configured it to never respond to any outside services nor pings. So yes I have unofficial non-Windows and technically oriented OS's... and I had Gentoo Linux on my last laptop... but I probably don't count because I am an admin just not by job this time around (I've been director of IT before)
First thing I did (Score:3, Interesting)
Months later, I walked away after initiating an (infrequent) reboot. After making the rounds, I came back to an NT login. WTF I thought - then realized I'd set NT as the default in lilo in case someone needed to use the copmuter.
Well.. does Knoppix count? (Score:3, Insightful)
We also have several Linux servers, but no desktops as of yet.
FreeBSD Under the Radar (Score:3, Interesting)
But IT doesn't know about it. I don't have their permission. But guess what? IT doesn't own this computer, my department does, and I got my boss's permission, his boss's permission, and the permission of the VP above him. I would have told IT, but then they would have a cow and it would become a big pile of political crap. But IT doesn't know, so they're happy, I'm happy and my boss is happy.
I'm certainly not going to tell them about the development lab being switched over the FreeBSD, the Dicom lab running Mandrake, or any of the internal websites running Redhat and SuSE.
It slipped into my workplace quickly. (Score:3, Insightful)
After we began shipping a linux version of our main server product, I began to notice more and more linux desktop ( and cygwin ) installation on our staff systems. Now, even my project manager and the company owner have seperate or dual boot linux desktops that see significant use. All it took to get all this going was a few internal howto documents that walked them through a simple secure installation.
This obviously couldn't happen in a more regulated atmosphere, but at small companies like mine you can often get away with anything you want so long as you continue to be productive and do not cut into the IT budget.
BLH
where I work (Score:4, Interesting)
The home office has a special network security "swat team". Last year, they did a security audit of our site, which consisted of trying to hack into our network, from the inside.
They found several rogue Linux boxes, and were able to hack into them through ftpd. Holy hell was raised. All Linux was purged from our network. Oddly enough, here it is, 8 months later, and nearly every developer has a second box on his or her desk, with, you guessed it, Linux. However, it's a distribution and configuration, approved and controlled by IT.
It's all about control with these guys. .
You'd think that black leather keyboards with spikes and clamps would be popular with these freaks.
Look at the sysadmins waving their wangs around (Score:5, Insightful)
If you were actually any good at your jobs you should be asking why these people (who may or may not be risking their jobs) feel the need to install linux? What is it that the current policy doesn't provide? Why has sysadmin become so unapproachable that they did it without asking (this should be an easy one)?
Actually do something useful rather than wandering around the network marking your territory.
Re:Look at the sysadmins waving their wangs around (Score:3, Insightful)
First of all, I don't do desktop support--I work entirely on the heavy server end, and am fairly regularly calling the desktop guys for permission to install this software or that on my PC (if I have one--most of the time these days, a Sun box does everything I need).
But any medium+ sized company will have a policy (and it's generally a blanket policy) about installing software without authorisation. This is a Good Thing, with a Good Reason: Companies are LIABLE for their machines!
Install a virus o
Underground network (Score:3, Interesting)
Unoffical instals of ANYTHING is not allowed (Score:3, Insightful)
Not cool.
Rogue Installs... Allow me to Retort... (Score:5, Funny)
So who and where the hell are these marauding rogue agents running around installing Linux on office desktops. It can't be IS, they're too busy, and it can't be cube workers, they're afraid of their CDROMs!
We used to be a windoze only shop... (Score:3, Interesting)
I hope to have the whole company converted by christmas!
WinXxxx Only Option on IT Forms (Score:3, Interesting)
Running FreeBSD as the primary and only OS on three machines at work, I have a really hard time with these forms. What further investigation revealed (as I wanted to give them the CORRECT information despite their problematic form) was that their bonehead Access database required a primary OS from the list, with an optional secondary OS from the secondary list - no other options could be entered. So my three computers were registered as Win 2000 primary OS and Linux for secondary OS. Despite repeated pleas by me, we're paying Microsoft for three unnecessary liceses.
What annoys me most is that when ever I say "FreeBSD," my supervisors always hear "Linux." They aren't against Linux (or FreeBSD for that matter) as it seems many of your bosses are. Linux is a keyword in marketspeak, so it's acceptable. When asked about why they hear "Linux" when I say "FreeBSD," I was told that the "Free" in "FreeBSD" makes it sound cheap (in quality) to administration and potential customers. Using it is OK, but not to the outside world (or department).
Re:VMWare rules! (Score:5, Insightful)
I have a hard time getting my company to purchase anything beyond the minimum tools I need (NuMega and similar were out of my pocket, since I didn't mind owning them myself). VMWare's been on the wish list - but only as a wish.
Re:VMWare rules! (Score:3, Interesting)
However we didn't blow $400 on VMWare we needed it. Our product runs cross platform on Windows and Linux and wanted a way for the developers to be able to use both cheaply. Dual booting isn't an option because it's very slow to change context and you don't want to have two email clients, etc. to manage (or only be able to check email etc. when in one ope
You Have Been Served (Score:5, Funny)
}
}
} In the matter of SCO
} vs.
} Electric Cloud
}
}
}
Said defendent is alleged to have been running an unlicensed version of Lie-nucks, violating vaguely alluded to (but impossible to produce) 'intellectual property' alleged to belong to litigant, by virtue of having been written independently to superficially resemble an unpopular operating system the litigant overpayed to acquaire the rights of (c.f. UNIX), said litigant thusly excersizing their Constitutional Rights (tm) to sue uppity upstarts who dare make use of a legally engineered and freely provided system that competes with their abysmally unsuccessful, outdated, and buggy commercial offering.
Said litigant cites as prima facia evidence of infringement "a post to slashdot that indicated a successful deployment of the demonic system."
Defendents declined to comment, but did point out to the court that the daemon was a mascott for another, competing free operating system, and that perhaps counsel for the plaintiff would be so kind as to wipe the froth from his mouth and clarify.
Re:VMWare rules! (Score:5, Funny)
But wait! There's more! The first Karma-whore to post about VMWare on Slashdot will receive some moderation points... absolutely FREE!
Order your copy now, while there's still time!
---
Sheesh.
I *wish* I had to time to make obnoxious posts to slashdot all day.
Er.. wait a minute...
Re:This is unexpected? (Score:5, Funny)
Re:This is unexpected? (Score:3, Informative)
Re:This is unexpected? (Score:3, Insightful)
If I ever found out my employers were spying on me, they would probably have my resignation by the end of the day.
Re:This is unexpected? (Score:3, Insightful)
Ummm... because they can't "click" to install Linux. Sure, some of the bootable installers are pretty easy and click-able but it generally requires removing the Windows partition.
Users are dumb.
Create a Windows-installable Linux distro that will coexist/dual-boot on NTFS and you will have tens of MILLIONS of Linux installations. Hell... if you could make it install itself with
Re:This is unexpected? (Score:5, Interesting)
From a personal perspective, my previous employer didn't give a rat's ass what OS I ran, as long as it ran the software we used. The reply I got when I asked if I could was something like "oh sure, but you do it on your own time, and if it breaks, don't come whining to us..."
Re:Remember... (Score:5, Insightful)
Re:Remember... (Score:4, Interesting)
I'm not a sysadmin, but I'm one of the people that has installed Linux (I didn't blow away the corporate windows install, for accounting sakes) on his own at work.
How did I get the corporate mail client (MS only) and other ends to work? I downloaded custom-wrapped wine rpms created (on their spare time) by other coworkers on the other side of the country at another research facility. This was hosted on a un-official internal "Go Linux!" website, for all of the company's employees to see (we're allowed to have personal and "club" websites) and download (they have all of MS Office 2K running smoothly, along with Notes, the corporate e-mail client).
I got a couple of coworkers excited about Linux -- mind you, we're not just another corporate center, this is a hardware R&D filled with geeks (the sort of people that aren't sysadmins, but might play them on slashdot!) so I imagine we're at one end of the scale in the corporate world. But, thanks to Knoppix (try out a recent Linux distribution with zero liability on the company's computer to see if all your stuff is recognized! What a sale!) I've managed to get even some of the "old crusties" excited about Linux.
Anyways, my sneaking suspicion (and my hope! so this probably biases my "suspicion") is that there is a large number of uncounted Linux installs, and growing.
I was concerned about security, but who are we kidding? I know to not rest on laurels and all that (keep this RH73 as up to date as possible), but the alternative for my machine is Win2K, and we've been through the wringer with updates, worms, reboots and virus infected computers on *that* platform
Re:they better not (Score:5, Funny)
Apparently you've confused Linux for a version of Windows.
This kind of sysadmin crap is why I prefer working for a small company.
Re:they better not (Score:5, Interesting)
Oh, for the miniscule number of Linux viruses?
no agents for our desktop license management
Since *most* software that requires license management is either Windows-only or hard for Joe User to come by, I don't see this as a huge problem either.
and almost certainly wouldn't be keeping up with security updates.
Ah, now this is a real concern. I would hope that your company has firewalls, but I can certainly understand not wanting them to be your *only* line of defense.
the users don't own their machines - the company does. if they want to piss around with _any_ os, let them do it on their own time, on their own network, and on their own equipment.
I can certainly understand this. When you're responsible for eleventy jillion desktops, you can't have people going rogue on you. At least not without knowing that if you have to come fix their PC, it's getting reimaged.
Now, I personally happen to run a stealth RH install, dual-booting to Win2K for when I just have to do something in Windows. My workstation, however, is well-secured, and has updates applied regularly. I have *never* had to bug the IT department, and my workstation is exceedingly well-behaved on the network. If the IT department decide to be real hard-asses about it and reimage me, I'll understand. Doesn't mean I won't be cranky, though.
Re:they better not (Score:5, Insightful)
Maybe the authorization got misrouted.
Maybe you are wrong about either the authorization or the requirement for it.
Maybe it was an experiment on a dept. system.
Maybe it wasn't hooked to the network.
Maybe we were testing the system's Linux compatibility at the end of the day and left it 'till the morning to finish.
In my tenure at Dell, all these things were true at some point or another, and no one formatted our systems. We were too busy to get in the pissing matches that would have started.
Certainly you should quit abusing your very limited power and try to help rather than simply jumping to conclusions.
Re:they better not (Score:5, Insightful)
If end users are not supposed to do something it's your job to configure the gear so they can't. Rules forbidding something are a failure in IT.
If the user has no agent for the desktop license management how is that a problem exactly? Either they are not using any licensed software our your management software is not to hot on the managing front.
If you're running round playing tattle tale who do you think the finger is really pointing at? Go back to your sever room and lock the door.
Re:they better not (Score:4, Funny)
Re:they better not (Score:3, Insightful)
I certainly see your point. The company pays to maintain my laptop for me, the company pays for the support and pays for me not to have to worry about it. They pay you to do all that for me.
I see my employer as someone who pays me to do a job. I'm not that good at windows. I can do many things with *nix better or faster
Extreme prejudice 101 (Score:5, Funny)
localhost / # format c:
-bash: format: command not found
localhost / # fdisk c:
Unable to open c:
localhost / # deltree *.*
-bash: deltree: command not found
localhost / # del *.*
-bash: del: command not found
localhost / # sys c:
-bash: sys: command not found
localhost / # help
GNU bash, version 2.05b.0(1)-release (i686-pc-linux-gnu)
<snip>
</snip>
{ COMMANDS ; }
localhost / # fsda;lkjafdjl;kwfoied
-bash: fsda: command not found
-bash: lkjasdjl: command not found
-bash: kwfoied: command not found
localhost / # <insert_vcr_led>
Sobbing....I HATE LINUX....
Somewhere a penguin smiles.
This is why I hate IT departments (Score:3, Insightful)
Re:they better not (Score:4, Insightful)
You need to find a good surgeon to remove the stick from your ass...
Basically, what you're saying is that you aren't confident enough with your security measures that anyone inside your network can wreak havok? In a big company, that's pretty fuckin' pathetic; a rogue user had better not be that big of a security concern!
the users don't own their machines - the company does. if they want to piss around with _any_ os, let them do it on their own time, on their own network, and on their own equipment.
IMO, this is exactly what is wrong with corporate America. You're not a person, you're a drone, don't try to learn anything.
Re:they better not (Score:3, Funny)
Someone did this in my company to a laptop four years ago. Just last week I noticed he was still sitting funny after the impromptu buttectomy the VP gave him.
Re:they better not (Score:3, Insightful)
> any imminent linux virus threats.
That attitude works up until the world gets surprised by the first real nasty one.
> Desktop license management?
> I thought linux was free.
Perhaps, if your time is worthless. But anyhow, he was refering to license management for any potential commercial software they may have illicitly installed.
> If you have the ability to install linux,
> you probably have the ability to install
> security updates.
Perhaps, but yo
Re:they better not (Score:5, Insightful)
> That attitude works up until the world gets surprised by the first real nasty one.
should i even bother explaining why it is damn near the most unlikely thing to happen in IT ? or should i just point out that _if_ a virus ever hits a unix there would be open source anti-virus software within a few days ? (few months max) or point out that the unix type of OS is about 30 years old. and to date there havent been any virus's in the "wild". (and dont give me that "not attractive target" for virus writers crap either, unix still runs mainframes, bank computers, ATM's etc
se the wonderful thing about linux is you dont have to run a damn thing as root, and the few things you do have to run as root can be chroot'd so the virus/worm can't do diddley. some linux distros come like this by default.
>> Desktop license management? I thought linux was free.
> Perhaps, if your time is worthless. But anyhow, he was refering to license management for any potential commercial software they may have
> illicitly installed.
oh please. take your gartner studies (microsoft funded BTW) and shove em'. the amount of time it takes to install and optimally config a std. linux system is in the hours worth of time. admining that same install MIGHT take 30minutes per month. windows ? yeah friggin right, pick one of their OS's if you spend less than two hours per month admining that box its vulnerable. this argument is moot. since anyone who is going to install linux by choice obviously wasnt bugging the IT guys and hence didnt need to be trained, so there is no time lost their.
Linux is FREE to any person who knows what they are doing, simply because spending the few hours it takes to install free's them of the years of misery that lies behind them, and the years that would have laid ahead of them if they had still been running windows.
Re:they better not (Score:4, Insightful)
Ummm...actually, in 1988 (fifteen years ago) Robert Morris wrote a worm that attacked UNIX machines via a number of different routes (holes in sendmail, finger, and a few other approaches that I don't recall at the moment). In the space of something like 24 hours, Morris' worm brought thousands of computers to a grinding halt (a fair percentage of the machines that were networked in the US at that time), and those computers were running UNIX.
This is actually the worrisome issue: a *NIX is not inherently more secure than anything else. I think that there are UNIX-based machines out there that are far more secure than anything else you can find, but that's becuase those particular machines are administered by paranoid freaks...paranoid freaks that are extremely good at what they do... :)
I'm guessing that this isn't the case, but if your position is that "'I don't have to run a damn thing as root' and therefore my linux box is by definition going to be secure forever," then going to get screwed -- and screwed hard -- one of these days.
Re:they better not (Score:4, Insightful)
It may be suprising to you that his job depends on ensuring corporate standards are in place and enforced on IT infrestructure.
I understand a user wanting to run thier own show on the workstation assigned to them, but if a major problem with Linux surfaces and the sysadmin didn't do anything about a non-standard installation that they knew about, that's akin to dereliction of duty, and they should be fired. A corporate environment requires stringent management, or it spirals into a huge, black, money sucking pit.
IOW, it's up to the SA to ensure that everyone plays nice on the network. If you want to use Desktop Linux at work, ask . Maybe the sysadmin be a lot more friendly towards the idea - I know I would.
Soko
Re:yep... (Score:3, Informative)
Just because you can only boot from the HDD doesn't mean you cannot install anything you want! You just have to work around the problem. For example you could use VMWare to boot your distro and then install to the real hard disk. Alternatively you could simply use rawrite to overwrite the mbr (tricky to construct your mbr ... but possible). Now if your OS that you can boot from won't let you access the mbr and the raw disk, then you'll just have to whip out the hard disk to do your installing and th
Re:Now that's one of those Ask Slashdots even I ca (Score:5, Funny)
Re:User Installed *anything* (Score:5, Insightful)
If I install a program as a user on my Linux box, or even in my user space on the departmental server... it has no effect WHATSOEVER on the rest of the server or the other users. Thats what a multi-user OS "is". You can't even TOUCH that with ANY Windows implementation.
This discussion is not about "Oh, I can break into any box and install Linux". Sure you can. There is no way to stop. Lock it up? pick the lock. Remove the floppy and cdrom? install one or do a network install via crossover cable and another box. Blah blah blah.
The idea is that Linux IS in far more places than people know. And it will only grow in the future. Will it supplant MS as the "King of the desktop"? Who the hell cares... but people have a choice now.. and they ARE choosing it.