[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Testbed-admins] problem adding the first non-admin user in Emulab 5.0



It's possible to turn this off with a site var:
    general/joinproject/admincheck

... though we don't recommend it - the idea is that there are enough
things that project members can do that having a non-admin in a
project with admins might make it possible for the non-admin to
escalate his privileges and gain admin access.

Locally we deal with this by having alter-egos that do not have
admin privs. These are the accounts we use when we need to be a
member of a project that includes non-admin people.

We are probably more worried about this then others might, cause we
have so many users from so many places, most of whom we do not know.
Extra caution is good.

Lbs