On 8/20/06, <b class="gmail_sendername">Sharon Nagao</b> <<a href="mailto:sharon.nagao@gmail.com">sharon.nagao@gmail.com</a>> wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div>Michael,</div>
<div> </div>
<div>Thank you for the excellent suggestions. I will look into tripwire immediately. </div>
<div> </div>
<div>As for feeling the pain by the DBAs, that will take some time, thinking and discussion with the other admins. I would appreciate it if people could share their policies/procedures if they have them.</div>
<div> </div>
<div>Any other advice by you or others would be most welcomed.</div></div></blockquote><div><br><br>I must have well behaved DBAs! We have very well defined roles for system administrator and DBAs. We, as sys admins, are responsible for the operating system. So the DBAs send us the requirements, like kernel parameters for upgrading from Oracle 9 to 10. We add swap space, change kernel params, and get the operating system all set. We then add them into the sudo list so they can run their install. When they no longer need sudo, they call us and we remove access.
<br><br>I guess it has more to do with environment. Where I work, they have done a very good job defining roles. Sys admins own the operating system and therfore responsible for it. Application owners own the application. Sys admins don't go changing apache config files, just as the web team doesn't go changing kernel parameters.
<br><br>One thing is maybe to get the boss or whoever to define who is called or responsible if the server goes down in flames. If you are the person called, you can make the argument that the DBA's could (and will) hork a config killing the server at 3am causing a phone call to you.
<br><br>A sneaky thing you might try is to casually let who ever does network/cyber security or audits know about it. If your company has to get audited (Sarbanes or whatever), this could be something that might raise a flag. Whoever the person is that gets the brunt of the audit is probably going to go nuts if he/she has to explain security or policy violations.
<br><br><br></div><br></div>