Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!sample.eng.ohio-state.edu!purdue!haven.umd.edu!umd5!cogsci!wjb
From: wjb@cogsci.cog.jhu.edu
Newsgroups: comp.unix.admin
Subject: Re: Who gets accounts (was Re: Advice, opinions, and ideas sought.)
Message-ID: <26.Jun.91.134632.69@cogsci.cog.jhu.edu>
Date: 26 Jun 91 17:46:32 GMT
References: <1991Jun26.120235.27892@mp.cs.niu.edu> <45275@netnews.upenn.edu> <22300@uudell.dell.com>
Organization: JHU Cognitive Science Center, Baltimore, MD
Lines: 38

In article <22300@uudell.dell.com> sblair@upurbmw.dell.com (Steve Blair) writes:
>
>A user is caught by the watchful eyes of the sysadmin group attempting
>to connect to machine/companies/etc., that that user should *not*
>be connecting to. A sysadmin from one of the other sites calls *YOU*
>on the phone, and tells you:
>
>"Someone is attempting to connect to our site from yours, and they've
>not got a reason/account/friend here".
>...
>I've had this at a company(NOT DELL) where I used to work, and it
>took me a few hours to determine that this employee was *not*
>just playing around.

	Your idea of a paper trail sounds like a good one and it sounds like
you dealt with your situation (gathered your own evidence) in a reasonable
manner.  Written policy is also helpful.  I do have problems with this
statement though:

>"Someone is attempting to connect to our site from yours, and they've
>not got a reason/account/friend here".

	I couldn't possibly accept that statement without question.  The
administrator hopefully would know that my user didn't have an account on
their machines, might by talking to EVERYONE at their site discover that my
user didn't have any friends there, but unless telepathic couldn't possibly
know if my user had a reason (good or not).  An administrator does not
become a deity upon reaching that status (I should know), nor are all users
scum.  Again, it seems like you had a real situation and handled it
judiciously.

	For discussions on a different example, take a look in
"comp.admin.policy" where disagreement on whether the actions of the user
were "wrong" not to mention the appropriateness of the administrator's
response.  My point here: be sure you know the difference between "facts" and
"assumptions" and with which you are dealing.

				Bill Bogstad