In addition to being the āLeoā in Ask Leo!,Ā I administer web servers and websites for a few friends and organizations andĀ host email accounts on my own servers for a few others.
What Iāve come to realize over time is that in doing so, these people haveĀ placed a tremendous amount of control in my handsĀ ā more than you mightĀ imagine.
What Iāve also realized is that this isnāt uncommon. In fact, whenever youĀ have someone manage your businessās website, server, or email, be that person aĀ friend or a hired service, youāre probably giving them more access than youĀ realize.
Itās often the right, and even necessary, thing to do.
Your sysadmin might not tell you how much power he or she reallyĀ has.
I will.
Become a Patron of Ask Leo! and go ad-free!
In defense of your sysadmin and sysadmins everywhere
I have to start by saying that Iām not implicating system administrators atĀ all. They really are the backbone of the internet, keeping the digital wheelsĀ greased and pistons lubed, making sure that websites work and emails get sentĀ 24 hours a day, seven days a week.
What I do want to make clear is just how much power you might inadvertently be giving your system administrator. Iām not even saying that doingĀ so is wrong; in many cases, itās exactly the right thing to do.
Itās just important to realize how much access and control youāreĀ giving your system administrator, so you can make informed decisions when youāreĀ looking for help.
Different types of sysadmins
We use the term āsysadminā to refer to people who administer your system āĀ but āsystemā is somewhat vague.
For purposes of this discussion, a sysadmin could be:
- Someone who sets up and administers your email server, or even just theĀ accounts thereon.
- Someone who sets up and administers, modifies, or maintains your webĀ site.
- Someone who sets up and administers your web or other type of server.
- Someone who sets up and administers your internet domains and DNS.
So with all that in mind, here are a few things that your system administratorĀ might not tell youā¦
1. āI can read your email.ā
If your email ever touches a system managed by your sysadmin, or if theĀ sysadmin is the person who sets up new email accounts and perhaps resetsĀ passwords for you, that person very likely has the ability to read yourĀ email.
The most common scenario is that you hire someone to work on your website. Say you own somerandomservice.com, and you have someone come in and build you aĀ website there from scratch.
If you also get your email via that same domain ā say your email address isĀ leo@somerandomservice.comĀ āĀ then itās possible, and Iād guess fairly common,Ā that this person you just hired has access to your email.
Letting your sysadmin have that access might well be a good thing.
I know that having that kind of access has allowed me to quickly determineĀ and resolve issues for my clients. I certainly donāt make a habit of readingĀ their emails ā a clear invasion of trust and privacy ā but the ability toĀ quickly swoop in and see if theyāve received the test message that I just sentĀ them, perhaps repeatedly, can be extremely helpful when tracking down a thornyĀ issue.
If you donāt trust your system administrator and you want your emailĀ (leo@somerandomservice.com) to be on the same domain as your business websiteĀ (somerandomservice.com), there are technical solutions to separate the two atĀ the server level. The problem is that they are technical solutions,Ā and if youāre not up on those technicalities, youāll need to trust someone to put them in place.
2. āI can impersonate you.ā
With access to your email, itās not very difficult for a sysadmin to sendĀ email that is truly from your account. Iām not talking about all the ways emailĀ can be spoofed, or even hacked; in many cases, a sysadmin simply has directĀ access to your email account.
Done properly and with malicious intent, it would be extremely difficult toĀ prove that an email sent by your sysadmin was not actually sent by you.
Given all the ways that email can be forged and spoofed, this may notĀ necessarily have true legal ramifications, but at a minimum, it could beĀ exceptionally embarrassing.
3. āIāve copied all your files.ā
This is obvious when people think about it, but people rarely think aboutĀ it.
When you have someone work on your website for you, they have access toĀ everything that might be stored there, whether itās something theyāre workingĀ on or not.
That means that they can copy it.
Once again, this can be a good thing, depending on your sysadmināsĀ motives.
I periodically take a complete copy of at least oneĀ clientās complete website as backup.Ā I do this simply because I know sheās not that great at backup, and the hostingĀ service that sheās using doesnāt offer it. In fact, given how paranoid I am aboutĀ backups, itās replicated across three or four machines here at home, and in twoĀ separate data centers off-site. Sheās probably getting better backup thanĀ anything a web host might provide.
I also use whatās called āsource code controlā when I work on peopleās webĀ sites. Without getting into geeky details, it means that I keep a copy of notĀ only the current website, but every change that has ever been made to it sinceĀ I took over working on it.
The risk, of course, is that should she and I ever have a falling out, IĀ could run off with all of her content ā intellectual property that sheās worked forĀ years to create and accumulate. Who knows what I could do with it?
And of course, I wonāt. Can you say the same about your sysadmin?
4. āI can hijack your domain.ā
Itās not uncommon to hand off the management of your domainĀ (āsomerandomservice.comā in our example) to your sysadmin. They take on theĀ technical details of āDNSā: making sure your site can be found on theĀ internet, the correct server is reached when people try to visit yourĀ site, and email is routed appropriately.
Quite often, with that type of access also comes the ability to take actualĀ ownership of the domain, or, at a minimum, to redirect that domain to servers andĀ content that isnāt yours.
Having someone manage your DNS is not uncommon, as itās critical that it beĀ done correctly for your website and email to function at all. But once again,Ā youāre giving that person control of a very important and valuableĀ resource.
5. āI can shut you down.ā
Itās a joke that I never make1, but Iām occasionally tempted to say inĀ jest, āDonāt piss me off ā you know what I can doā to some of myĀ clients.
And itās true. I never, ever would, but in many cases, a sysadminĀ could block your email, take down your web site, replace it withĀ less-than-desirable content, destroy your online records, and lay waste to pretty much all of your digital assets and online reputation.
They can take your site and your email off the internet. Completely.
They could also do something much simpler. I heard one apocryphal storyĀ of a website designer putting up derogatory statements about a client onĀ the clientās own website because a bill had supposedly not been paid.Ā True or not (and legal or not), itās entirely possible, and it would not surpriseĀ me in the least if it had happened more than once.
6. āIām at risk here too.ā
What a lot of sysadmins donāt realize is that many of the risks Iāve listedĀ above can be turned around to cause them trouble as well. They may not tell youĀ this simply because they havenāt realized it themselves.
By taking on such open-ended access2 to my clientās systems, I actually put myself at someĀ risk as well.
A good example is email. If I can send email that looks like it came fromĀ my client, then I could be accused of sending email that looks likeĀ itās from my client, even though I had nothing to do with it. I certainly haveĀ the means and opportunity. Regardless of who has to prove what to whom, theĀ accusation couldĀ cause a great deal of difficulty.
Similarly, consider the backups Iāve taken of my clientās site. If for someĀ reason I should accidentally allow those to fall into the hands of a hacker, at a minimum Iāve violated her trust.
7. āI can be your partner.ā
With all of the control given to a sysadmin, it might be easy to think of themĀ as scary people to tip-toe around, so as not to annoy them in case they decideĀ to extract costly revenge.
If thatās the relationship you have with your sysadmin, itās time to find aĀ new one. Now. Change your passwords (and perhaps more)Ā and send him or her to the curb.
A good system administrator does more than configure a websiteĀ or email.
A good system administrator can be a partner in helping your business grow.
Thatās a role I try to play.
A good sysadmin will be up-front and honest if you ask about the risks that IāveĀ described here, and should be able to explain possible alternatives to helpĀ reduce your exposure.
A really good sysadmin will look at what you have and suggest ways toĀ improve it-Ā perhaps making it faster, easier to use, or less costly.
And the truly exceptional sysadmin will already have told you everything youĀ just read.
Do this
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
I'll see you there!
6. āIām at risk here tooā
ā¦
Similarly, consider the backups Iāve taken of my clientās site. If for some reason I should accidentally allow those to fall into the hands of a hacker at a minimum Iāve violated her trust.
=====
By extension, the same thing you say about e-mail applies here. Suppose a hacker were to steal the admin login information from the client, and use that to grab a copy of everything on the website. You could be accused of being the source of the leak, just as you could be accused of being the one who sent that āembarrassingā e-mail.
=====
Thank you for pointing out this not-necessarily-complete list. Many people hear āif you donāt trust your sysadmin, replace himā, but donāt necessarily understand why. I think this list of the highlights should help get the point across.
Now that was a good read! Itās my guess 95 percent of website owners have no clue about the real power of a system admin. As usual, you laid it out effectively, simply and with great clarity.
This should be required reading for every business owner that has a website. Heck, I know a guy that has a big list that surely has hundreds, if not thousands, of business owners on it. Iāll tell him to talk about this article.
Unfortunately, all of our worlds have become so complicated and technically oriented that we do little for ourselves outside of our world of expertise. Not only Sysadmins are involved here, but also our doctors, lawyers, cpaās, our priest, minister, rabbi or imum, our state and federal governments, our banker ā just about anybody we come in contact with on a professional basis has that power if they turn evil, and we have enough wealth to make it worth their while. As they say, āThereās no such thing as a free lunchā. The more people to whom we are forced to open our lives, the bigger the risk. Miserere nobis (Have mercy on us).
Leo, you hit the nail squarely on head. But your focus on the sysadmin position is a little to narrow.
Consider the lowley computer technician who comes in occassionally to repair/replace workstations. He/she will need to have several keys to the kingdom to accomplish the work and can run away with the crown jewells as well.
Thereās a dimension to this discussion that goes beyond trust. I have seen many of my customers effected by vendors that they knowingly or not trusted with aspects of their business only to have these vendors go out of business leaving them in the lurch for access to their own critical programs, website, servers, email, etc.
I think the other take away from your article should be to understand the technical aspects of your business well enough to understand just what you are trusting both your contract labor as well as your employes with.
ā¦AndĀ having read all that about your SysAdmin, now feel free to ignore all of it completely.
Because ā quite frankly ā there is no Earthly you way you will ever be able to do without him.
10-Feb-2012
Have to agree with Glenn P. as you said, once we get outside of our own area of expertise, we are at the mercy of others. Including doctors, lawyers, sysadmin, etc.
My point is simply that we have no choice in the matter ā itās a ātake it or leave it, my way or the highway, any-color-as-long-as-itās-blackā, Hobsonās Choice situation. Itās not that the information isnāt āimportantā, only that we canāt actually doĀ anything with it (and if you think we can, Leo, you deceive yourself).
10-Feb-2012
Leo, Iām really starting to lose patience with what I perceive to be a (surprisingly) simplistic attitude on your part.
SysAdmins are notĀ chosen by customers. They are chosen by the ISPās.
Did I really need to sayĀ that?!
And which ISPĀ you end up with isnāt always (or, isnāt always fully) within your control; it may depend on where you live, which company you work for, which online service(s) you subscribe to ā or even which brand of computer you use or buy!
As the letter āiā said to the symbol āpiā, āPlease, be rational!āĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā :)
12-Feb-2012
Leo is right. I administer a number of websites, email, host websites (and administer some local networks ā and am a ālowly computer technician). I am not associated in any way with their ISPs, and am hired ā and could be fired ā by my clients.
Leo, U rock.. & keep Rockin` On. Bless U. Again, love your articles, views & the HELP u give to us non-techie Mortals.
[coff] May I interrupt, here, please ?
There is an eighth thing that you probably donāt know ā that is about back-ups. You can be sure(?) that the SysAdmin will set up a proper back-up system, but that back-up will be to protect *her*, not you. i.e. if there is a fire in your building and you lose āeverythingā, her back-up will enable her to re-create the system exactly as it was when she took the last back-up. But if *you* lose a file by mistake, do not expect her to be able to retrieve just that one file at the snap of your fingers. When working for another company, I have always kept my own back-up as well, i.e. copies of every version of all important documents.
Not sure I agree Robin. Yes, I have selfish motives for maintaining the backup system ā I want to have a job after a disaster not only because I donāt want to get fired but because I need my employer to survive the event.
That said, systems are set to backup specific stuff (file servers but not local desktops/local āmy documentsā folders) because there are limits and storage costs money. We tell people what is and what isnāt backed up and on what schedule. If staff work within the system that had been setup based on managementās allowed budget, I will recover your stuff and if I canāt, it is my fault. If staff donāt work within that system, it isnāt my fault.
You said āby mistakeā. Yes, we all make them. If I was a web admin and I mistakenly didnāt make a personal backup ā just in case, then it would be my fault. The difference between staff and techs is techs are expected to be less likely to make these particular type of mistake (backups). Instead, we are more prone to making other types of mistakes.
That said, I havenāt made a backup on my home computer since I donāt know when. I guess I just donāt want to think about backups when I switch off at the end of the work day. :)
You donāt want to think about backups after the end of a workday. This will work until the day your hard drive dies or is seriously infected with malware. Then youāll have a lot to think about. I have EaseUS Todo on autopilot set to do monthly system image backups and daily incrementals and set to delete older backups automatically. The only time I have to think about backups is if I have a problem which can be solved by my backup. Of course, I check periodically if those backups are there and working.
I use Teamviewer to help a few friends with their computer issues. I have them give me a one time session login and not a login I can use at will. I have them sit at their computer and watch everything I do, which is is also useful for them to learn and hopefully save me from being called the next time the same problem comes up. But itās also to prevent any suspicion that something I might have done caused them to have problems. This wouldnāt work in cases of professional support, but itās a good way not to lose friends.
The ones who are watching you and you think are being enlightened are still clueless.
And you will still be blamed.
You know, since last week when you fixed my computer the cat has been limping. Can you please take care of that?
Youāre right. One time I sat next to someone who had a computer problem and told her what to type. After that session, her computer crashed irrecoverably (it was probably her dying hardware which caused the problem in the first place) and she blamed me for sabotaging her computer. But in the majority of cases, people appreciate the transparency even if what they are viewing is opaque to them.
The ālast person who touched itā rule.
Whew, I was lucky in that one. She wouldnāt let anyone lay a finger on her laptop.
Funny thing, just before coming to this article today, I was on a remote TeamViewer session helping a friend with a computer problem
I look after the computer and network infrastructure for a 15-person accounting firm. I had to sit down with the founder and explain the facts of life: once I log on as Administrator, I have access to absolutely everything. If I donāt have access to everything, I canāt fix problems that arise. And these accountants are very inventive when it comes to causing problems.
This may be beyond the scope of this article but Iām wondering if there are any professional certifications or organizations available that would let customers know that the system administrator that they are trusting is, in fact, worthy of it? Financial advisors, building contractors, plumbers and electricians, to name a few, have licensing oversight and I would think a SA would benefit from that as well.
Secondly, I think an article about what to look for in a Systems Administrator would be helpful to those of us that need to hire such a person.
Del,
I canāt say Iāve ever heard of any organization, professional or otherwise, that would provide a level of trust as would a contractor or other such trade professionals. Some fly-by-night scammers will often present themselves as being licensed and bonded, but unless you specifically ask what theyāre licensed and bonded for, itās probably nothing more than some online certification which often means little or nothing.
The best way I can think of is to get a number of references and check them thoroughly. If they have none, then give them a wide berth. If they are someone who is experienced in the field, they will have plenty of people willing to vouch for them and their expertiseā¦not only clients, but other IT professionals as well. Leoās a good example ā people know his work and experience and freely recommend him to others for his expertise.
Jonathan
I have a small website which I manage myself. But that doesnāt get me off the hook. The web hosting company also has all of those powers. Itās run by a friend, but that could be a problem in itself as he might have more interest in reading my emails than a stranger :-)