I'm a junior-ish employee at a company (I'm not technically junior experience-wise, but I'm junior compared to the massive amounts of experience everyone else has and I've been here the shortest).
One of my senior co-workers is about to retire and is becoming a bit forgetful. He often doesn't follow the rules, doesn't really understand security and just does his own thing. People overlook this because he's brilliant and a veteran in the industry and we all respect him.
Today, he emailed me the root password to one of the main servers. I know I'm not supposed to have this password because in the past my boss has specifically done things for me on the server instead of giving it to me.
I am aware that this is a big security problem. Aside from the fact that I now know the password, it also was emailed (!) to me, which is in itself a huge security breach.
I think I should tell my boss about this so that he can have the password changed, but I'm struggling to figure out how to go about it. I don't want to come across as a tattle-tale. I like my co-worker and I don't want to cause trouble, but in my mind this is a very big issue that my boss should know about. I am questioning if this is really is as big of a deal as I am imagining it to be. My coworker seemed to think it was no big deal.
So my question is, Should I bring this matter to my boss, and if so how do I tell my boss about this security breach without sounding like a petty tattle-tale?
Why he gave me the password:
My coworker wanted to supply me with files from his user directory. I suggested he (1) copy them to a common location or (2) change the permissions on the files so I could read them. He opted to email me the root password so that I could use su and copy the files myself.
Usually the servers have sudo access - I have sudo on another server that's less critical - my coworker could have given me sudo access instead of giving me the password.
I'm aware that root password login is an insecure thing. I don't know if the server has the root password login enabled because I've never tried to use it. I ssh in using my user key-pair.
What he said about giving me the password:
I asked him if it was ok that I have the password, and he said "sure" in a hand wavy sort-of way. He seemed to think it was no big deal. I'm not super comfortable in any case, because I don't report to him, and he's know for not taking security seriously.
The company IT dept
Doesn't exist. There was a linux admin but he left months ago. My boss is the closest thing to an IT dept we have.