112

I'm a junior-ish employee at a company (I'm not technically junior experience-wise, but I'm junior compared to the massive amounts of experience everyone else has and I've been here the shortest).

One of my senior co-workers is about to retire and is becoming a bit forgetful. He often doesn't follow the rules, doesn't really understand security and just does his own thing. People overlook this because he's brilliant and a veteran in the industry and we all respect him.

Today, he emailed me the root password to one of the main servers. I know I'm not supposed to have this password because in the past my boss has specifically done things for me on the server instead of giving it to me.

I am aware that this is a big security problem. Aside from the fact that I now know the password, it also was emailed (!) to me, which is in itself a huge security breach.

I think I should tell my boss about this so that he can have the password changed, but I'm struggling to figure out how to go about it. I don't want to come across as a tattle-tale. I like my co-worker and I don't want to cause trouble, but in my mind this is a very big issue that my boss should know about. I am questioning if this is really is as big of a deal as I am imagining it to be. My coworker seemed to think it was no big deal.

So my question is, Should I bring this matter to my boss, and if so how do I tell my boss about this security breach without sounding like a petty tattle-tale?

More detail:

Why he gave me the password:

My coworker wanted to supply me with files from his user directory. I suggested he (1) copy them to a common location or (2) change the permissions on the files so I could read them. He opted to email me the root password so that I could use su and copy the files myself.

Usually the servers have sudo access - I have sudo on another server that's less critical - my coworker could have given me sudo access instead of giving me the password.

I'm aware that root password login is an insecure thing. I don't know if the server has the root password login enabled because I've never tried to use it. I ssh in using my user key-pair.

What he said about giving me the password:

I asked him if it was ok that I have the password, and he said "sure" in a hand wavy sort-of way. He seemed to think it was no big deal. I'm not super comfortable in any case, because I don't report to him, and he's know for not taking security seriously.

The company IT dept

Doesn't exist. There was a linux admin but he left months ago. My boss is the closest thing to an IT dept we have.

closed as off-topic by Jim G., JakeGould, Masked Man, gnat, Chris E Apr 24 '17 at 21:01

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address only a specific company or position are of limited use to future visitors. Questions seeking legal advice should be directed to legal professionals. For more information, click here." – Jim G., JakeGould, Masked Man, gnat, Chris E
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Comments are not for extended discussion; this conversation has been moved to chat. – enderland Apr 19 '17 at 18:50
  • 9
    @stanri If your only goal is to get the root password changed, why not just ask the one who shared it with you to get it done. "Thanks for sharing that with me for this task. {boss} opted not to give it to me in the past, so I don't think he wants me to have access. Can you please get the password refreshed?" – Myles Apr 19 '17 at 18:51
  • 11
    @cybernard If it went out over unencrypted email, it absolutely was released to the public. The public may or may not have been paying attention at the time, but there's no way to determine that. Regardless of whether the OP gets to know the new one, that password needs to be changed. – Ray Apr 20 '17 at 0:17
  • 2
    @Ray if it's a small company with a most-senior IT person who's lax about rules and gives someone a root password out of simplicity, it's possible that the e-mail server is on-site and doesn't have reliable archiving of mail; so anyone with "root" can read anyone's mail that hasn't been deleted, but it's possible that e-mail isn't "released to the public". Any more detailed discussion probably belongs on Security stack exchange, however. – david Apr 20 '17 at 1:32
  • 1
    Also, does the company have any policy or procedure in place for accidental disclosure of a privileged account? My personal preference for my team would be along the lines @tkp posted; but once upon a time someone let the lawyers revise our IT and IT Security policies. Now, if I find out someone didn't promptly report an unauthorized disclosure as a potential breach, I'd have to write them up and discuss why we shouldn't let them go with the general partners. But if they raise internal alarms and we do that rigamarole, they're safe. So 1st things first, follow your policy at a minimum. – Ruscal Apr 20 '17 at 20:21

13 Answers 13

128

First, it is ABSOLUTELY a big deal! Anything that can compromise your data security is a big deal. Your company is not only at risk for the liability of the lost / compromised data, but its reputation is at risk, as well.

You would be extremely negligent if you did not report it. A pattern of breaches is of serious concern.

Now, beyond that, don't try to make any determinations as to why your coworker is doing this. Give only the facts to your manager, and then let your manager handle it as they deem fit. Don't dwell on it. Don't ask your manager for the "results" of your information. Report it, and get back to your role.

Your manager may just decide to change the password and "wait it out" until this person retires.

  • Comments are not for extended discussion; this conversation has been moved to chat. – enderland Apr 19 '17 at 18:50
  • 16
    I would add that if the OP has this password and doesn't tell anyone, the OP putting himself in a precarious position. If something bad happens to that server and there is a review (perhaps by a third-party) the fact that the OP received this will not be hard to uncover. Not only will suspicion immediately fall upon the OP, the fact that this wasn't reported will be an issue itself. You don't want this kind of liability. – JimmyJames Apr 21 '17 at 15:33
100

COMMUNICATE

Go talk to that person and ask them WHY he emailed the password to you. Just emailing a password out of the blue seems rather odd.

Then ask if it is OK for you to have it - explaining what your boss always does for you - and explaining that you don't want you or him to get in trouble and want to make sure the boss is ok with it.

Once you have WHY, then ask the next question: "I was always told not to email passwords due to security risks. Is that safe to do here?" Wait for the answer. Perhaps he knows something you do not.

Then ask the next question - "Why are we using root passwords anyway?"

If this guy is as brilliant as you say he may have a valid answer to all of them.

But, at the end of the day, he needs to fix the problem (if there is one) and this gives him a chance to do so without you looking like a tattletale.

  • 28
    This is the approach I would take initially because it assumes good intentions and create the opportunity for the person who made the goof to help solve the problem the goof created. I prefer to solve problems as far down the org chart as possible, and only move up the chart when that doesn't work. In addition, I would endeavor to get the root password changed, especially if I am indeed not supposed to know it. I want to protect and support my co-worker and the organization. – Wayne Conrad Apr 18 '17 at 21:53
  • 12
    In addition, if you do have to go to the boss, it's much better for you and your co-worker to go to the boss together. That way you are both cooperating to solve a problem and clearly not engaging in any kind of politics. – Wayne Conrad Apr 18 '17 at 22:34
  • 5
    +1. Improving interpersonal relationships while solving the problem. @WayneConrad of going together to talk to the boss is the perfect closing point. – OnoSendai Apr 19 '17 at 0:41
  • 9
    +1. And further to this, it does depend on what lives on that "main server". If it's just your build machine, and the builds are all running within VMs, chances are that you won't care too much about who's got root access to it, so long as you trust them not to be overwhelmingly stupid. In this case, he's told someone who he knows and trusts. And unless it was an external email, it never left the building so it's not any real risk. As you say, there are a lot of ways this can be a no-big-deal situation, and a nimrod novice kicking up a fuss with managers is not going to be appreciated. – Graham Apr 19 '17 at 11:01
  • 3
    @stanri - using su to get a root shell is usually a concern. However, whether or not it is a concern for your organization is up to your organization. I would consult with the guy that gave it to you - and find out WHY he doesn't think it is a big deal for you to know it and to use it. I would also find out if it is common for the other senior staff to operate this way or not. Once you know the WHY then you will have better information to make a sound judgement as to what to do next - especially if the rest of the senior staff are using the root password as well. – user45269 Apr 19 '17 at 22:50
76

Let your boss know, but do it in a way that isn't "tattling".

There's a difference between asking "Is it okay that Bob did X" and "Is it okay if I do Y (given X)". Go to your boss ask for permission for yourself to use the root password. You said that your boss always does these things for you, so the answer is likely no.

Hey boss, I was wondering, do you need me to check in whenever I want to make changes as root on Server X in the future, or can I just go ahead and do it? Bob emailed me the root password, so I could do it myself if that's easier.

This notifies your boss of the security threat, but also isn't flat out snitching on your coworker. Your boss can decide how seriously to treat this (though I would hope he at least changes the password). If he acts shocked and starts pushing you on the details, you could even throw in

Yeah, I thought it seemed pretty odd, which is why I wanted to ask you about it.

  • 47
    You're assuming that the boss is security-savvy enough to pick up from a casual aside in a conversation on unrelated issues that something has gone seriously wrong. This may not be the case. I think that "we have a serious security problem" is not something you should be coy about. – TRiG Apr 18 '17 at 20:19
  • 14
    @TRiG If the boss has refused to give the OP the password in the past, then I would think they would be competent enough to pick up on "Hey, I have the password now." – David K Apr 18 '17 at 20:39
  • 77
    I don't agree with this answer, because it makes the OP sound completly unaware of the huge security issue at hand, and because it counts on the boss to dot the i's. – njzk2 Apr 18 '17 at 20:44
  • 8
    I'd advise against straight up telling that Bob sent the password. You can leave that as ambiguous as needed unless the boss asks for who did it because if it's an honest mistake, as long as it's addressed it'd be fine. – Daniel James Apr 18 '17 at 20:47
  • 10
    Agree with @njzk2, and you have a choice of displaying yourself as competent (as far as you are) or pretending to be incompetent. For your own career, it seems wiser to display knowledge and responsibility than to fake ignorance to maybe help your colleague. – user985366 Apr 18 '17 at 21:49
38

A small startup with <10 employees, no IT staff, no Linux admin and everyone else has been there much longer? Chances are good that everyone else knows that password as well, and everyone knows that everyone knows, and nobody thinks it's serious enough to do anything about.

I am aware that this is a big security problem. Aside from the fact that I now know the password, it also was emailed (!) to me, which is in itself a huge security breach.

Breach of what, specifically? General industry good practice, your company guidelines, specific industry regulation that you need to comply with, or specific orders from your boss?

All too often random people will know root passwords, the domain admin passwords, each other's passwords, and all sorts. It feels like it should be a big security problem - but most employees aren't hostile and most companies aren't hiding nuclear secrets and mostly life goes on. Ideally they should be changed regularly as a procedure, so when they inevitably leak, there's a limited time window where they can be used harmfully.

You're in a trusted position as a small company employee. Be trustworthy by not abusing the things you accidentally learn. But so are all the other employees, and it will likely take a big security fail before the company internalises and enforces anything like "less convenient, more secure procedures all round".

  • If it's a regulatory compliance thing, with customers at risk, fines possible, definitely tell your boss. In that case, it is your job to be a tittle-tattle because you work for the company, not Bob.
  • If it's about covering your butt in case your boss finds out you know and gets punishy, definitely tell your boss, but perhaps leave Bob out of it. "Hey, I asked for access to some files on this server, but someone sent me the root password instead. I don't want to drop anyone in trouble, but you should probably reset that password if I'm not meant to know it".
  • If it's a company policy thing, probably tell your boss. You say that "He often doesn't follow the rules, doesn't really understand security and just does his own thing. People overlook this because he's brilliant and a veteran in the industry and we all respect him." - well if everyone knows Bob is lax about security, then you are neither a tittle-tattle, nor throwing him under a bus, you are a junior working picking up menial problems on behalf of a veteran and tidying them up, and helping the company deal. Great, no problem.
  • If it's about industry good practice, well congratulations, security is now your job if you want it, because clearly nobody else there wants it. Write a short report for your boss, extolling the virtues of sudoers, a shared password vault, auditing, regular password rotation, nobody having root passwords, etc. Offer fixes and how you would implement them and how long it will take. Boss will like you more. Maybe.

And if it comes down to it, and you have to take sides between Bob (soon to retire) and your employer who pays you and you might work there for a decade yet, your loyalty should be to your interests (i.e. the company). Annoying Bob annoys Bob a bit, a security breach which causes the company to fold makes everyone unemployed, a reputation for being the sneaky junior obtaining passwords he shouldn't have access to could drop your reputation into the gutter.

[This is not in anyway intended to approve of his approach, but to put it in context of a real world small company with no dedicated security stance, and your role as an employee out for your own interests rather than a manager or director].

18

Since you've stated that your company doesn't really even have an IT department, I'd say that for the specific context, which some of the other responses don't seem to consider, you'd probably be wasting your time.

There's an assumption upon which you are basing your question: "I know I'm not supposed to have this password because in the past my boss has specifically done things for me on the server instead of giving it to me." How do you know?? Have you actually asked the reason why you weren't given the password? Sometimes, busy bosses will handle a task themselves rather than taking the time to make sure their reports are doing things correctly -- in small shops, there aren't always many other options. And quite reasonably, when the boss needs to take a day off, other employees will eventually need things like administrative account access to get things done.

That said, do not be so quick to react. Leave the e-mail where it is. You might mention, in passing conversation, that you have the password for the box and ask your boss if he feels comfortable with you logging on and taking care of things here and there. Don't make the other guy the emphasis of your conversation, because that's not your job. You may get a yes, a no, or he may put it off. Be prepared to accept any of these responses.

Stay out of the business of what this other person does on your job, UNLESS that's in your job description or causes a conflict with you getting your work done.

  • 1
    Glad you posted this. I think many of the other answers are missing the context of the OP's workplace and are making assumptions based on their own desires, beliefs and workplace requirements. – Cypher Apr 19 '17 at 17:03
  • 8
    +1 for pointing out the elephant in the room. I don't see any other answer questioning the OP's assumption that he shouldn't have access. Yes, having the password in email is a security breach, but from OP's point of view, him having the password is only a security breach if he thinks that he himself cannot be trusted. – Wildcard Apr 19 '17 at 17:45
15

Don't assume there's a problem.

Maybe you're getting a promotion. (Even if not a financial raise, or a new title, you have now been given access.) If the person who is leaving had many elevated responsibilities, there may be an expectation/hope that people will step up and start taking over new roles.

When you go to the supervisor, don't approach the giving-you-access as a problem. Inform your supervisor that you now have access. If it's a problem, then corrections can be made. If not, then enjoy the fact you've now been entrusted with this.

If you approach this as telling your boss about a factual matter, just so the boss doesn't get surprised in a more unpleasant fashion, then this needn't look like a tattle-tale issue. This is simply bringing someone up to speed about the latest security settings. Not a problem.

Chances are that this old-timer knew that you didn't have access; that is why the password was shared. (If he thought that you should have access, and already had the password, then he wouldn't have shared it.) This may well have been an intentional, and approved, act.

As for the part about it being in E-Mail, that might be a very big deal or not at all, depending on factors like how secure the E-Mail tends to be and how important this particular password really is. If you have higher standards, live up to them (by not sending such E-Mails yourself), but I don't recommend faulting your friend (who entrusted you with a password) until you confirm the organization's stance on what is or isn't acceptable handling of this data.

5

First, as a practicing InfoSec professional (IT auditor), I wholeheartedly agree with the remaining answers

You must tell your boss and IT Security function if you have one

How do I tell my boss about this security breach without sounding like a petty tattle-tale?

You did not say what content is stored on the server, whether it contains sensitive information, or whether its a "live" production server. You also don't know whether your coworker emailed the ROOT password to other unauthorized employees at your company or to external third parties. Unlike yourself, others may be just like your coworker and brush off the incident.

However consider this fact : Who knows what malicious intent a particular insider employee, competitor, or cyber - criminal may have?

As to what can happen once the root password is compromised from a security CIA perspective:

  1. A malicious individual now can get complete control over the server and override other security settings set by your IT folks.
  2. He can delete / steal sensitive data that may happen to reside on the server (violation of integrity)
  3. He can bring the server offline and deny access to legitimate users (violation of availability)
  4. He can intercept communication (violation of confidentiality)

If your work in a regulated field such as health care, certain regulations apply such as HIPPA. Penalties for incidents can be severe. Even if your industry is not regulated, consequences can still be severe in the form of lost current business as well as prospective future business if the password incident exposes customer data.

To summarize my point:

The security implications of this incident is far more serious than a perception of you being a "tattle tell" would be. How would you feel if a data breach happened and you did not tell your manager, who could have mitigated any fallout?

  • 4
    On the other hand, if an employee has physical access to the servers and malicious intent then a root password is merely an inconvenience. In a small company that's often the case, and employees are generally trusted anyway. The "malicious employee" is usually a big-corporation thing. Typically too the server would be hosting VMs which actually do the work, and they may have their own security. I'm not saying that it might not be a serious security issue, just that it isn't automatically one. Unfortunately the OP hasn't given us enough info to take a better guess though. – Graham Apr 19 '17 at 11:20
  • 2
    My company has 35 full time employees, and about 60 contract employees. In the last 5 years, we have had 4 malicious employee incidents, including one at a very senior level. I was actually recruited to repair his damage. You're never too small to ignore risk. – Wesley Long Apr 19 '17 at 19:45
1

While it is true that this is a security issue (first of all, to give you the root password; second, to send it by mail, which is in itself not secure), there does not need to be an issue for you to solve with your boss.

A diplomatic and yet ethical solution for unwanted passwords is: un-learn the password. This means deleting the mail you got, cleaning your mail system trashbox, not copying it into your personal password safe. If the password is easy to memorize, so that it is hard to erase from your brain, then make a point to never use it although you know it.

The next, equally important, step is to let the sender now. This can be done in completely neutral, "egocentric" fashion: "I feel uncomfortable having that root password; I have deleted it and will not use it. I know whom to contact when I need access and will work on that machine together with them, if need be." If they are at all sensitive to security topics, they will get the point. If not, then it does not matter anyways. Do this communication in the same medium you got the password (just reply to the mail you got from them, obviously replacing the actuall password with "***") to get a paper trail, just in case.

Putting blame on them or even taking it to your boss seems to be a sure-fire way to not having such a great social environment afterwards, and will likely do nothing at all to further the security of your place.

There is a reason that larger companies have a separate entity (CISO or something like that) to handle these issues outside of the general managerial hierarchy.

1

Personal anecdote time (because it's always personal anecdote time):

I left a company under, uh, less-than-favorable circumstances. I had been the CTO, so naturally I had access to every system. A few weeks later, I noticed that my user-name and password still worked on the production database.

This was typical of the kind of slip-shod behavior that led to my leaving in the first place. Disgruntled ex-employees are always the first suspects if there is a hacking attack, and if one happened, I didn't want anyone to be able to say that "Well, Malvolio still knows the password."

So I sent an impersonally worded email to the CEO, telling him to change it.

Two weeks later, I checked again, and it had not been changed. I sent the CEO an even more impersonally worded email, to the effect that if my password still worked in 48 hours, I would post the username and password on Hacker News.

My sources reported back that the CEO instantly called a meeting of all the remaining engineers and ordered that every password and every username in the system be changed.

He wasn't very bright.

But that wouldn't be a good solution in the OP's situation, even though he is in almost a precarious position as I was.

Since he does not wish to appear petty, this is the perfect time to rely on the passive voice:

  • the password "was mailed to him"
  • the email "might be read"
  • perhaps therefore the password "should be changed"
  • and even a new policy "could be promulgated"

It's not great prose, but it's good politics.

0

My first thought would be to go to the person who sent you the password and tell him that he really shouldn't be doing this. I wouldn't see any need to get him in trouble with the boss. Your co-worker was trying to help you out. It seems pretty slimy to report him to the boss for breaking rules in the process of trying to help you. If I thoughtlessly broke some rule company policy when trying to help another employee and he promptly turned me in, you could be sure that would be the last time I did anything for him. His next request I'd tell him he must submit a request through his manager to be processed through proper channels.

You didn't say what sort of information is on this server. If it's something that, if compromised, could get people killed or at least cost the company a lot of money, more forceful action would be called for than if all that's on it is the archive of the past 50 years of the company's newsletter. Likewise, is it a server that is accessible over the Internet, or is it only available on an internal network? Etc.

  • This is the pettiest answer. "If I broke the rules it shouldn't matter, if I'm held to them then I'll get my revenge by ... HOLDING THEM TO THE RULES! SURELY NOBODY COULD ENDURE THAT!". That ... is exactly what you should do. Hold your coworker to the 'proper' channels. Distributing load through the proper channels is how a structure stays up rather than falls down. – TessellatingHeckler Apr 19 '17 at 17:26
  • 2
    @TessellatingHeckler that depends a very good deal on how the "channels" are arranged. Most big companies end up with labyrinths, not channels. The only way anything gets done is by one or more minor or major bypasses of "proper channels." (However, I have worked in one solitary international organization whose channels were so well thought out and intelligently and efficiently used that bypassing them was always a short road to trouble. But that's the exception in the modern world, not the rule.) – Wildcard Apr 19 '17 at 17:49
  • @Wildcard I disagree. If the channels are awful, they should be allowed to overflow. If every request comes back "approval needed from finance for purchases over $99 and they've a two week backlog, that is the feedback which management needs to justify streamlining the channels. On the other hand "purchase complete [by pulling a favour with M--- in finance]" leads to stuttering apologies to customers when their "2 day" order takes 2 weeks because "nobody" knew there were bribes and favours necessary to do it at the promised time, and half the company with no favours to call in is stuck – TessellatingHeckler Apr 19 '17 at 18:18
  • I am reminded of an associate who was once hired as a consultant by a British company to help with a labor dispute. When their union wanted to fight management but didn't want to go so far as a strike, one tactic they used was what they called "to rule". They would follow all company policies TO THE LETTER. They had people search company rule books and policies for the most obscure and out-of-date rules, and then they would rigorously follow them until management gave in to their demands. – Jay Apr 19 '17 at 20:32
  • @Jay, that's known in the military as a "white mutiny." – Wildcard Apr 19 '17 at 22:57
-1

I think I should tell my boss about this so that he can have the password changed, but I'm struggling to figure out how to go about it. I don't want to come across as a tattle-tale.

So I don't think you need to be told that your boss needs to know: the goal is merely to inform your boss in a way that your co-worker will not perceive as calling the cops on him.

The first thing is to realise that this may not be possible -- if he's absolutely determined to be offended then there's no way to tell your boss and not offend your colleague. But then, that's his tough luck for (intentionally or accidentally) creating an incentive for others to conceal his errors.

Next, go back to your colleague and tell him (don't ask him) that unfortunately you're not allowed to have the password he's just given you. You know this because your boss controls that password and has refused it to you in the past. So, because you now know it: either you need permission from your boss to have the password, or else the password needs to be changed. This would be the case regardless of how it was given to you.

Furthermore, because it was given to you by email, most likely the password needs to be changed anyway even if you are given permission to know it. If the password in question is very low-value, and your email system is reasonably secure, then your boss might choose to accept that risk, but that would have to be due to a specific calculation. For a somewhat contrived example: if remote password login is disabled, the machine is virtual (hence has no way to login from a local terminal) and you were the one person left with access to the machine who doesn't already know the root password, there may be no immediate risk in painting the root password in 10 foot letters on the side of the building. But it's still not good general practice, so your boss might well opt not to do that!

This lays out the problem, as you see it, to your colleague. Crucially, focus on the problem being "I know this thing I shouldn't know", not "you did this thing you shouldn't have done", and don't talk about blame. You could then offer two solutions:

  • Your colleague approaches your boss to sort this out.
  • You handle that for him, and approach your boss yourself.

Now, at this point the colleague might offer a third option, "do nothing and don't snitch on me". In that case, you cannot avoid offending him and must do as your conscience dictates regardless of the unpleasantness associated with that. But if he takes the first option, let him do his own damage-limitation with your boss and then ask your boss some time later what the outcome was so far as it affects you. This serves two purposes: you want to know your level of access to the machine, and it keeps your colleague honest if for whatever reason he'd prefer to say he'll approach your boss and then actually not do so.

If he takes the second option (because he feels there's no damage to him in you going to your boss), you can go to your boss and not worry about the consequences. If you're correct, that he's uninterested in security, careless, and completely secure his position, then I think it most likely he'll take the second option. If he wants to cover himself he might well take the first.

You may also wish to take up with your boss the issue of why anyone is using the root password at all, in preference to properly managing the list of sudoers. But that's a separate task. It's one of the causes of this problem, but acknowledging it doesn't clean up the mess.

-1

Nah, it's probably fine. Do mention it to your boss to check if they want to reset the password after you're done with it. If they don't, ask whether you need to follow any additional protocols now that your access level is elevated. The thing is, if your coworker was in position to give somebody the password it means lax security whether or not they actually gave to anyone like you.

On a security note, consider re-configuring your servers so that root access is managed without sharing passwords (special account with sudo privileges is a common pattern).

  • 1
    Poe's Law would appear to apply to this answer. – Carl Witthoft Apr 19 '17 at 18:42
  • Well, I am aware that my advice is against most best practices. It is however the way it's done in many small companies, and OP sounds like it is a small company, no separate IT dept or anything so I think it's practical enough (besides, as long as everyone is aware of the situation and no harm is done..). And I think it's better to prevent such situations with mechanism, not policy. – Ivan Anishchuk Apr 19 '17 at 19:29
  • @IvanAnishchuk The servers are configured to use sudo. My coworker isn't an admin, he happened to know the password and gave it to me instead of giving me sudo access (which he could have done, but I don't know if he knows how). – user5621 Apr 20 '17 at 10:56
  • My point was it's possible not to have root password at all. It's not always optimal but sometimes is more secure. – Ivan Anishchuk Apr 20 '17 at 15:18
-5

You can deal with the tattle-tale issue in a way that managers sometimes do. Identify "everyone", without singling out the person. Unless pressed on for information.

You: Boss, I need to "copy files" from "server" to complete my task. I find it that I can do it myself as I am now in possession of the root password to the server. Will it be okay for me to go ahead and copy my files?

Boss: What? OMG! Password?! Security! How?!! Who did it?!

You: Someone from staff sent me the password when I asked to help me with my task.

Boss: Who did it?? It was Bob, wasn't it?? He always does this stuff.

You: I prefer to not throw anyone under the bus, but perhaps point out that we have a culture of lax security in the office, and I think we can improve on it. Password was sent to me by email.

Boss: Tell me anyway or everyone will lose.

You: It was Bob. Bob did it. Also, sending a plaintext root password over email is a big deal and a major security problem that puts entire company at risk and liability.

  • 1
    Ignores the problem with plaintext password in email. -1 – Wildcard Apr 19 '17 at 17:46
  • 1
    wow, seriously? most unhelpful answer to this question by votes? Wow – Dennis Apr 19 '17 at 19:04
  • 6
    This is way too passive-aggressive for an important issue. What if your boss is distracted and doesn't even notice the part about you having the root password? Something as important as this deserves to be called out explicitly rather than hoping someone picks up on your subtle cues. – Chris Hayes Apr 19 '17 at 23:02
  • 3
    As Chris commented, just hinting at an issue instead of addressing it directly is always bad form. It leads to guessing, gossip, needless emotions. – Jan Doggen Apr 20 '17 at 7:29
  • 3
    "Tell me anyway or everyone will lose" - are you sure "Boss" isn't actually a character in a badly translated Zelda cut scene? – amelvin Apr 20 '17 at 9:39