1

Having a backdoor account (that is a username/password that can login in to an administrative account on all machines) can be very useful for IT staff. However, some believe it's a security breach. What are the pros and cons?

Pros

  • access even if user forgets password
  • access whenever is convenient, for example if user of machine is away on vacation
  • another reason I just discovered is because if the user is non-technical they may misunderstand which password you are requesting, for example if they are running virtual machines.

Cons

  • may not be feasible when there is confidential information on the machine
  • A manager once told us that the company didn't have a backdoor account so that if something went wrong the finger could definitively be pointed at the end user

The last point doesn't really make sense to me. Most people would quickly hand over their login information to an IT staff. Even if they choose to type in the password themself, it's unlikely they will stand there the whole time and wait until the IT staff logs out. Furthermore if an IT staff is malicious then it's unlikely not having a password of a end users machine will stop him.

  • Are you sure you are not confusing backdoor account with a legitimate Admin or root account? Why would you need a backdoor if you already have legitimate control over the systems and the users cannot disable the legitimate access? If this is a business or org with a network, you would not normally need a backdoor to do any of the items under "pro" as those can be normal admin actives. – Eric G Jul 27 '14 at 3:57
  • @EricG maybe it goes by a different name but what I mean is having an account with administrative privillages that IT know the password to so they can log on. – Celeritas Jul 27 '14 at 8:46
  • The difference between backdoor & admin account is different - one is a secret & one is well known. A backdoor usually refers to when a company puts in an undocumented access for a product sold/given to a customer. The backdoor is then used to bypass normal controls; an admin account operates based on prescribed rules & is under the customer/your company's control. A backdoor account in the way I described would allow the vendor to get in an due stuff and bypass any security controls or options which you, the customer, have setup and control. Sardoc's answer is on the right path. – Eric G Jul 28 '14 at 2:36
  • @EricG we may be talking about different things. FIrst of all I'm not talking about a company selling a product to a customer that has an undocumented admin account, I'm talking all internally. Also I don't think it's right to just say it's an admin account - anyone could have an admin account and that's a rather generic way of saying it. I'm saying the IT has the same usernmame/password to an admin account on all machines they could be responsible for, and the end user of the machine isn't told the password to this account. What would you call it? You wouldn't just say it's a plain admin acnt – Celeritas Jul 28 '14 at 23:52
  • If you are on Active Directory and these are not local accounts, that would be the definition of a Domain Admin Account. Regular end users should not be running with admin privileges. The built in "Administrator" named account sounds like what you are talking about. Even if you are just using the local accounts, and regardless of OS, this is very common in organizations. There is a difference between admin privileges and an admin account. – Eric G Jul 30 '14 at 1:32
4

First of all, I would not call that a backdoor. A backdoor usually refers to methods of bypassing normal authentication, which would not include an Administrator account owned by IT. Nearly all corporations I have worked with have the IT department own the Administrator accounts and functions for all workstations and servers in the environment, whereas the end users just have unprivileged "normal" user accounts. There are a number of reasons for this:

  • This prevents end users from installing unauthorized applications on company owned devices.
  • Administrative functions, such as patching, can be centrally managed and ensured that they are applied in a timely manner.
  • When an IT services employee has to work on a device, they do not need the end user to be there.
  • Very Important: End users should be trained to NEVER give out their passwords, even to IT employees. It sounds like where you work, this is common. Above all, I would recommend an awareness campaign informing your employees to never give out their passwords to anyone, and make doing so against your corporate policy. This behavior completely invalidates your second bullet under your con section, and an employee can claim they gave their password to an IT person if anything "went wrong". Additionally, social engineering is the #1 way an outsider is going to get into your network... frankly, just flat out asking people for their passwords is quite effective in an environment like yours, even as a non-employee.

Eventually, you may want to look into an Identity Access Management (IAM) solution. If you purchase the right tool, the IAM solution manages all the administrator password in the environment, and each device has a different randomly generated password set. Any IT person that needs to work on a device must first log into the IAM solution with their credentials, "check out" the administrator password, and when done, "check it in". Once checked in, the solution will connect and change the admin password on that device, so only it knows the current password. If anything "wrong" occurs, you know the capabilities of the non-admin end user, and you can check the logs of the IAM system to see who had the admin password checked out for a particular device at the time to determine who caused the problem.

EDIT 7/27: Just to explain more regarding your below comment - small companies, such as a grocery store with 1 computer, generally have no data worth protecting (assuming credit card data isn't running through the PC), and so there is little reason to enforce an unprivileged user. Plus, grocery stores usually don't have dedicated IT folks supporting the single PC.

Large corporations, on the other hand, have significant amounts of data worth protecting. Forcing all users to run as an unprivileged user is a security measure to protect the company. Users are not security experts - they tend to download random software off the internet and install it. Often, this software has been backdoored by malware. Developers are famous for doing this, as they often like to "test" new tools. At best, this leads to an increased attack surface, at worst, the whole company's domain has been compromised.

Why do you believe developers need to be administrators to develop code? Speaking as a past developer, that is completely untrue. There is no reason to be a local admin to test/qa code. There should be a defined deployment process so that once a developer is done packaging an application, it can go through the corporate deployment/patching/update process to get pushed to the PCs that need it (initially, the qa testers). After the code makes it through testing, and is approved, it goes through the same process to be pushed to the rest of the company that needs the software installed to fulfill their job function.

That said, I am speaking about a more mature IT organization. It takes years to get there if you are starting from where it sounds like you are. Start small. End user/non-IT employees don't need to be administrators. Limit it to just IT initially. Develop your processes and procedures. Take a software inventory to determine what software is critical to the business. Eliminate everything non-necessary. Everything necessary becomes the "approved software" list. Anything not on that list, you will need an approval process to get put on that list. Continue making small, incremental changes, until you end up with a mature, and secure, IT organization.

Don't take my word for it:

  • "Nearly all corporations I have worked with have the IT department own the Administrator accounts and functions for all workstations and servers in the environment, whereas the end users just have unprivileged "normal" user accounts" are you telling me that most corporations you've seen don't let end users run accounts with administrative privillages. That's rediciouls. I guess it depends on the work, maybe if a grocery store has 1 computer that just is used to the browse the web it's ok, but how would a team of devs / qa get work done without admin accounts? – Celeritas Jul 27 '14 at 8:48
  • In short, developers and testers don't need administrator accounts to develop or test, unprivileged user access is all that's needed to run an approved IDE and compiler. There really is no reason for a day-to-day use of an administrator account. The typical use of admin accounts (even as a developer) is installing software, which is not something done often, so why run as an administrator the other 95% of your day? I edited my original post with more detail, and some links that may be of interest. – Sardoc Jul 27 '14 at 19:05
  • I certainly know some large companies that take a differnt stance, certain fortune 50 I can't name due to NDA. – Celeritas Jul 28 '14 at 1:14
  • Many Fortune 500s may not require a high security level within their corporation, or may have other potentially expensive compensating controls. Additionally, for a large global corporation, the more difficult and costly it will be to maintain this level of security. In this situation, the risk of compromise may have been deemed lower than the cost of the higher security level - I don't know since you haven't provided any evidence to your claims. The links and information I posted are just simple recommended guideline for basic security, it's not required by any means. – Sardoc Jul 28 '14 at 5:05
  • Right I'm just saying it's bs to claim that most companies don't have computers where the end users get administrative rights. – Celeritas Jul 28 '14 at 9:04
0

I am going to answer your question as a generalization of my real world experience.

Except for BYOD (Bring Your Own Device) workplaces, I would say that most work places supply their employees with the computers they are using. Which means that legally speaking the computers and whats on them belong to the company. Most companies will also have some form of IT policy that informs the users that any information they do at work while paid are also property of the company, such as e-mails sent, etc.

All companies I have seen that are large enough to have IT, have local admin accounts to access computers. This is because in my experience companies care more about convenience than they do security. Sure there is the exception, but trust me, most executives, and managers just want you to be able fix their computer with as little input from them as possible. Most companies will also have their domain admins group as a member of all computers local administrators group.

That being said, if a company is security savvy enough to not have a shared local administrator account on each computer, then they likely will have a pretty strict IT policy that tells you never to give your password to anyone, that includes IT. IT should never have to ask a user for their password. You can ask a user to login for you, to do something for them on their local profile, but you should not need to ask them for their password. Users will try though and it is your job as IT to correct them.

That being said I also believe that little of value should be stored on company workstations, local folders should have roaming profiles, or be mapped to a server, or have mapped folders, in which it is the company policy to store all your files on a server.

If this is followed properly it makes for much better security if a device is lost, recovery when a drive fails. It also makes backups much easier.

I know I answered a lot more than just your question, but I figured it may be helpful.

Paul Arneson

www.cluui.com

  • 1
    -1 Is this spam? The answer given has zero information and just reflects on your personal experiences. What is the link for, it seems like spam to me? – Celeritas Jul 26 '14 at 7:57
0

NO, period! the more 0 users the worse it gets.. just because script kiddies try the root user.. does not means they can't find any other username... what a surprise if someone cracks a dictionary made user for example "dcolings" and find out they are already user 0 ... there are hundreds of solutions for anyone to not loose a password or a ssh key.. if that is the reason.. one of this hundreds of solutions will be to use a encrypted file where you can safe your keys/passwords etc.. you just need to remember one password! you can even make this even more secure than just using a password but that is out of topic. And honestly nobody should be loging to a admin/root users.. people should log into their unprivileged user first and from there depending on the user use sudo well configured to not just allow plain root access..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.