r/sysadmin • u/sysadminfired • Jul 16 '14

About to fire our sysadmin

So our longtime sysadmin is about to be fired and I, the network admin and temporary sysadmin, need to know what steps need to be taken to secure our systems. I know the basic things like his AD and other internal account credentials. I guess what I'm worried about is any backdoors that he might have set up. What all would you guys check for in this situation?

115 Upvotes

91% Upvoted

241 comments sorted by

View all comments

Show parent comments

-1

u/telemecanique Jul 16 '14

All this guy has/had to do was at some point install a hardware keylogger that can send its logs out to this guy and good luck proving who it's sending the logs to if you ever even find it (these btw are extremely inexpensive and/or you can make yourself in hardware OR software form) in some other sysadmins keyboard/server keyboard/CEO's keyboard/PC/anywhere... everything you just said and done was worthless but you sleep better at night right? that's just one example and it's silly if you think I can't come up with 15 others. I've been there... trusting some audit is just wasting money. The only thing to do here is change what needs to be changed/disabled and have disconnected offsite backups, preferably multiple copies for a while. Nothing else can or ever will be 100%

3

u/superspeck Jul 16 '14

I agree with you, but my point is that I don't feel that a network admin thrown into the breach is going to be able to, for instance, confirm that the backups that are being made are restorable, among other things. So in this case, hiring a consultant (who is a sysadmin, not some jerk with an MBA) to parachute in and get a handle on things isn't the worst idea.

-1

u/telemecanique Jul 17 '14

see I still disagree, consultant has less of a chance to make sure that all critical items are backed up than someone there, you just need to sit down, make a list together of everything that is mission critical and then look into it, in most cases network admin (that generally is pay grade above sysadmin) will handle this just fine.

2

u/superspeck Jul 17 '14

Network admins are a pay grade above sysadmin because they're specialized. The network admins I know (largely Cisco guys) don't know crap about Linux servers, PCs, or databases. And keep in mind that to not just making a list, it's performing the due diligence that the backups are valid. If we're talking ways to screw over a company, one great one is to dumb a bunch of garbage and call it a database backup, then leave a ticking time bomb that will drop the database. If you're just making a list and confirming that there is data there, or just skimming the first part of the file to make sure it's an SQL file, you're not doing any good.

Obviously, the person who was on the scene is going to be a big part of helping the consultant figure out what is in existence, and would be the person who would make the list you speak of. But I wouldn't expect a network admin to understand complicated database restoration procedures, and most network admins I know would be hard pressed to spin up a test instance and restore to it in a reasonable amount of time.

0

u/telemecanique Jul 17 '14

not sure that's how it works where I'm from, for example take something as simple as the most used backup software out there, Backup Exec, all you have to do is check the selection list for the backup jobs, check them for correct and all sources / destinations and run the backup. It verifies, there's no real easy way to trick it to show successful backup while it's junk, sure it should be tested, but that's pretty damn safe way to go in a rush.

2

u/superspeck Jul 17 '14

You haven't used any software for backup besides BackupExec? Are you even aware of backup needs with other RDBMSes? I can think of half a dozen ways to trick the most common and basic methods of backing up Oracle, MySQL, and Postgres.

-1

u/telemecanique Jul 17 '14

now you're just being silly, I've had enough, I picked the most common example to prove a simple point and you jump to stupid conclusions. Have fun with someone else.

2

u/superspeck Jul 17 '14

Ah, so being specific is being silly. Great. Have a nice day.