Here's how this works.
At a previous employer's I sought out the IT security guy for a ciggy outside. As what I had found was dynamite, I thought it best to avoid a paper trail.
Me: "You know your new security system? Where all the servers have the same config and the only admin access is via gaining access to the management server, sudo and rlogin with full logging?"
Him: "Yes of course. What about it?"
Me: "Well you've blown that standard setup to all the servers. You can rlogin to the management server from any other server and many of the test / dev servers have known passwords, for obvious reasons. Thus with a test server I can get root on the management server and, from there, rlogin to any of the production servers, bypassing all the security and logging! I find this very handy, but it's probably not a good idea."
Him: "Shit. We were rather hoping to come up with a solution for that which doesn't screw up our standardisation process before anyone else found it....".
Me: <Stunned silence>.
Biting the hand that feeds IT
