Re: Application Admins with Local Admin on Servers

["Yousef Syed" <yousef.syed () gmail com>]

Hi Megan,
Just grant the developers SUDO access to the build area to upload
their files to. From there, they can run a build script (Ant/Make).

Wrap everything else with Policy and Procedure.

I've seen this approach used at various large banks.

Much as developers love to be root on everything - simply because it
allows them to make all the necessary fixes to the environment that is
necessary - they must not be allowed to do that outside a build
environment. Ideally, once they've setup a stable build environment,
they should provide IQ and OQ  documentation to the various Test and
Live environments' Admins. The Admins for those environments should
simply follow the IQ/OQ documents as appropriate in setting up their
relevant environments (Application Server/Database Server and any
other dependant system). Once these deployments have been practiced in
the various test environments for each test phase, following the IQ
for the final live environment deployment should be second nature.
Remember, System Test isn't just used to test the application
fullfills its requirements, but that the applications is also
serviceable/maintainable during it's lifetime.


ys


--
Yousef Syed
CISSP
"To ask a question is to show ignorance; not to ask a question, means
you remain ignorant" - Japanese Proverb


On 10/07/07, Megan Kielman <megan.kielman () gmail com> wrote:
> System Administrators -
>
> I am trying to get a feel for what other companies do with regard to
> application developers needing local admin privileges on servers. I am
> specifically working in a Windows environment but believe that the
> same principles would apply in any environment. Here are my questions:
>
> Do you grant admin privileges to application developers?
> If not, do you grant them specific access or do you take care of the
> work for them?
>
> I do understand that it is a violation of separation of duties to
> allow application developers to have local admin or root on systems, I
> am simply try to get an idea of what the rest of the community does in
> practice.
>
> Thanks!