I'm currently working for SaaS a company and as part of a security audit we were advised to remove all administrative access from all laptops/end-user pc's for a Principle of Least Permissions.

Is there any MDM/management software for Ubuntu that would allow us to remove root-access to ensure we're less vulnerable to malicious software/control what kind of software is installed?


For our Windows/Mac users this was achieved with relative easy, however we have quite a few developers (in fact, almost all) running Ubuntu. The current proposed solution is:

  • Running a VM with admin access for dev work
  • Having no admin access on the machine (no root/sudo/nothing)

I'm not a fan of this solution because it means more overhead and would require switching to/from the VM each time I want to check my mail (otherwise what's the use). I already proposed to switch away from Ubuntu entirely to Windows but this was not received with much enthusiasm from both devs and management.

  • 3
    What on earth were they assessing against? That's a weird requirement in 2021. As long as the user is not running an admin/root account to do normal dev stuff, that should be fine. sudo'ing is the answer to that problem. – schroeder Jun 4 at 13:40
  • Indeed. I would take that recommendation under advisement and then ignore it. In fact, gaining root access to a linux box is the last thing I would be worried about - I'd be far more worried about all the external systems the user has access to. Admin access is primarily a problem if it brings with it additional access in the network (via a domain controller). This is typically, but not exclusively, a windows problem. – Conor Mancone Jun 4 at 13:44
  • Granted, there are some extra things you could do with a sudo account that you can't otherwise (port scan? open a service on a protected port?), but that is unlikely to be anywhere near as dangerous as stealing all the access credentials on the dev box, and you just have to operate as the "regular" account to do that. – Conor Mancone Jun 4 at 13:45

Auditors in general audit against a set of specific rules, guidelines or baselines. If you don't produce a reasonable baseline yourself, they will use their own baselines, and then you get requirements like this.

The principle of least privilege (PoLP) refers to an information security concept in which a user is given the minimum levels of access – or permissions – needed to perform his/her job functions.

That means, that if you can explain why root-access is necessary for developers on their own laptop, then you can give them the root access. But you need to explain why it is necessary (and acceptable), and document that, with appropriate signatures.

You may also want to describe what security measures you have taken to minimize the risks. A possible set would be:

  • put them on their own network
  • firewall-off that network
  • any further separation between test, development and production
  • an awareness campaign (users only get root after a talk with the Security guy)

things like that.

Running a VM with admin access only moves the problem. You will get the same requirement/discussion of least privileges on the VM as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.