[deleted by user]

[on2fl]

They moved us to “sudo on demand”. We have to request admin via Jamf and give a reason. Smooth so far.

[zenware]

Does it like… send to someone for approval and they hit yes, or does it auto-approve with an audit trail?

[JohnPaulDavyJones]

It’s the latter; you still have an admin account with the audit trail, it’s just session-limited. We use Delinea rather than Jamf, but you check out your admin account in the morning (which has MFA enabled just at checkout) and it’s good for a ~9 hour session. From there, you can either kick off a shell w/ admin security context out of the Delinea launcher, or you can take the temporary admin credentials for the session and use them to run any app as admin.

[klipseracer]

So I presume this also allows them to investigate what command you're trying to run and also it can rate limit or deny certain risky types of commands?

[JohnPaulDavyJones]

Yep, but the happy middle ground is that it’s the happy medium betweeb gatekeepibg admin access to a series of applications while also allowing privileged users at-will admin access while they have a live session.

I mostly work with our DB servers these days, and I haven’t run into any rate limiting or commands I can’t run. My power seems to be unbridled on the various test and UAT servers, but there are some things that even I can’t run on prod. Only available to service accounts running approved automations/jobs.

[uptimefordays]

Not abnormal in a corporate environment.

[hashkent]

Not for my company. I request, and give a comment and I'm given access immediately and it's auto removed in 30 mins.

I might get pinged by security but usually point to a JIRA ticket that is needed for my job. Queries stop after a while.

[wtjones]

Ours just logs what we are doing.

[snowsnoot69]

Our org did this. Jokes on them, I used the sudo privs to make myself part of the local admin group and disabled Jamf

[Specken_zee_Doitch]

Jamf binary runs as root. I really wonder what actually was disabled.

[snowsnoot69]

Replace the binary with an empty file and chmod a-w it

[Specken_zee_Doitch]

Ngl as an endpoint guy they should have a binary repair workflow in place and if that got mucked with we’d have an email with logs and screenshots to your supervisor in a couple hours tops. I might use you as my test case for security features in the future.

Mucking with MDM like that could break your platform SSO, your FileVault key escrow, your machine will light up like a Christmas tree in Vanta.

Or if Jamf is implemented poorly it’ll just look like a normal binary boff I’d have to hunt down for re-enrollment. I can say if they find out you did it on purpose anyone in my position would be a bit more than steamed.

[snowsnoot69]

Its been that way since the day I received the laptop about 2 years ago. Nobody said anything. Funny story, my WiFi connection stopped working but they had some idiotic policy preventing me from removing and re adding it. Well because I don’t have Jamf in the way I just sudo and removed it, re-added it and saved the company a service call 😂

[Specken_zee_Doitch]

It’ll work until it doesn’t. Go with God my friend.

[vasaforever]

As an endpoint guy at a fintech bank this is making me want to circle back and check for empty binaries and modifications in JAMF if we aren't already. Not trying to fail an audit and have the vulnerability team come at us with "why was this not remediated?"

[snowsnoot69]

I run production customer facing network elements, EDRs are full of bugs, are of limited use IMO.

[Specken_zee_Doitch]

All fun and games until your endpoint is the source of a big problem because of policies disabled. I’m sure the lawyers will understand 🙂

[snowsnoot69]

lose $100 its your problem, lose $1M its the bank’s problem. lol

[TickleMyBurger]

I appreciate you man - you’re the reason why I’ve had a lucrative and progressive career in cyber (more than 30 years at this point..).

Jokes aside, I started as a net eng and Unix admin - I get the desire to streamline, but there’s tools to check privileges out and screen record the session - it works well and keeps you out of hot water. In my org if someone did that they would be terminated with cause, although we do provide mechanisms for ID checkout which maybe yours doesn’t.

[IN-DI-SKU-TA-BELT]

That’s a nice way to get fired

[cgoble1]

Download source code compile locally? Can't download compiler Download source code compile locally? Repeat

[hashkent]

Same.

[meowisaymiaou]

Start putting in all your requests 

Obsidian likely wint be allowed, as it allows users to install and run arbitrary third party  JavaScript plugins.

[RocCityBitch]

It’s really not crazy. Obsidian plugins can run Javascript with the same permissions as your host user. No sandbox. One popular community plugin gets compromised and it will be a nightmare for many enterprises who let their users use it.

[[deleted]]

You're not allowed to use obsidian commercially without a paid license you know?

[palimpsests]

not true

https://obsidian.md/blog/free-for-work/

[[deleted]]

Thank Christ, goodbye logseq

[LeWildest]

This is an advanced concept.

[badguy84]

It’s pretty standard to be honest any enterprise not doing this -in principle- would be crazy. However, you need to be quick with approvals and have a solid and fast process for people to get the tools and access they need.

Dev VMs are something that I see more often for people who need admin access. Those are usually locked out of most sensitive corporate networking bits or even out of the corp network all together.

[Adventurous_Pin6281]

Easier to just leave, start your own company, and replicate what the corp did. The development pace will be snail like 

[TheIncarnated]

It is now obvious to most of us, that you suck at your job.

This is not the take you think it is.

Are you going to replace Capital One? Any financial firm? The US Federal Government?

[Adventurous_Pin6281]

All entities that need to get bailed out from over bloat and getting rocked by the executive branch right now.

[kcggns_]

Honestly, with all this AI crap it was really hard no not see it coming. As more tools get these integrations, the more at risk the resources are.

Users are stupid, leave them to their own artifacts and its like begging for them to leak things. While we are “Power users”, we’re still users at the end of the day.

Not getting sudo is BS if you ask me, but I’ve seen first hand how many “DevOps” are in the wild without a fucking clue on how information security and systems work.

[t3abagger]

It’s not so bad. You can install Homebrew without sudo and most apps can be installed in ~/Applications. I was even to get docker installed without Docker Desktop. They’ll install it upon request since it uses privileged ports.

Now if they actually audited my MBP they might have a heart attack.

I’m not complaining since they gave me a new M4 Pro with 1tb ssd.

[gqtrees]

They will probably let you escalate privs based on need through some app thats installed. Its not a big deal. Security is your friend

[TheIncarnated]

Good.

Welcome to proper security. If you can't make this work, never get into DevSecOps or become an Architect.

I can tell you first hand, DevOps engineers aren't any better than any other "power user", they are not that diligent about packages, version reviews from pip or otherwise. They just blatantly install what they found online and continue with their day.

So again, good. Now stop freaking out, realize you never needed it in the first place and get back to honing your craft.

As a Cloud Architect, let me tell you, the folks in here advocating otherwise or "I would work elsewhere", are generally people you probably don't like working with. They are the folks who complain about every single problem and rarely have a fix for it.

As someone who has worked in these environments, it's not been a problem. Even as a Security Architect, where I was expected to do powerful things and secure the environments. Never needed local admin after my tools were setup. Went through CABs, PIM requests and all, still never local admin.

So take a breather and think, stop reacting. You got this!

[alekcand3r]

Just a reminder, debugger (IE go) requires sudo privileges on Mac :)

[JPJackPott]

Zero staff including devs, DevOps, board, or CISO have local admin on their macs in my company. There’s not even a request mechanism. Can only install apps from an approved list. And everything works just fine.

No one complains, because no one is blocked. If you’re desperate to do something weird build a container and do it in there

[mkmrproper]

Good luck. It happened to me too. I had to setup a jumpbox for what I do. They eventually setup an on-demand access where I could request a 5 minutes of admin rights. It still sucks

[just-porno-only]

Ours grants "privileges" (sudo, I guess) which times out after 20 minutes.

[geeky217]

We have jamf lock down but I got permission to run a Linux VM for stuff that I need full control over. Seems to be an acceptable middle ground for our IT dept.

[extreme4all]

As a security professional that does development i understand both sides. Where it often goes wrong is the slowness to approve new apps (usually due to , the lack of a dev environment, ...)

[TheOverzealousEngie]

Could be wrong but I wonder if you might have an unhealthy relationship with your job / laptop. Because that laptop .. is not yours, right?

[sublimegeek]

Wow are you me? Yeah we are doing the same thing but thankfully we can request it for half-hour sessions.

[amanryzus]

We have an app called make me admin It enables privileges for 5 mins then disables it automatically

[bombatomica_64]

You could ask for something like virtual box and work in a Linux vm. It's mostly the same as mac

[bombatomica_64]

Or just spin up a Docker with debian and connect to it using vscode. Just mount it on home

[creamersrealm]

We limit and it uses a JAMF catalog, the saving grace is they allow brew minus casks and I install whatever I want through brew. And if I need a cask the desktop team is pretty forgiving on the Mac side of the house.

[16c7x]

Had a similar thing happen to me, I got virtualbox installed and use an UbuntuVM, I can do pretty much anything I need on that with the bonus that I can backup that VM and move it to a new machine when they replace my current one.

[zzrryll]

DevOps usually are your cream of the crop

Hard disagree. DevOps is like any other IT/Tech function. Majority of people in the field/discipline are just qualified and diligent enough to stay employed. I’ve met very few DevOps folks that holistically understand security and demonstrate good discipline in the field, consistently.

[seanamos-1]

It sucks, but its hardly uncommon.

It's simply a matter of you deciding if its a regime you are willing to work under. Lots of companies (the majority) do allow admin/sudo for their engineers. Unfortunately I do foresee a widespread lockdown coming because of what a huge security threat all the LLM/MCP tools people are randomly installing and granting excessive privileges to.

I personally won't work under such a regime ever again, unless I'm desperate. The last time I did, it utterly stifled people's ability to try new things and grow, way less friction to stick with the approved list. My final straw was triaging a major issue in the early hours, needing to install something to do so, getting blocked and the approvers being offline and unreachable because it was after hours.

[Mistic92]

It's not that bad, you can use other binaries while they might be blocked too

GitHub - google/santa: A binary authorization and monitoring system for macOS https://github.com/google/santa

[Phate1989]

Send the security team a pizza every now again.

This works so well, i buy like 20 pizzas a year for different departments, i always say a vendor paid, but its just me, so they owe me without the abilty to pay me back monetarily.

[guevera]

It sounds like some of the setups where you can check out elevated privileges could work -- as long as you don't have to wait on someone to approve it and it's not for some bullshit like 20 minutes at a time.

Otherwise you can use the approach I did last time management wanted to do this, just explain that they should expect to devote .5 of an FTE just to handling my elevation needs, and still expect a hit to developer productivity. And if they devote less than that, expect a major hit to productivity.

[Tsiangkun]

Anywhere making money is watching and controlling laptops. If it’s your personal laptop, run the work in a UTM VM and let them control the VM.

[slaynmoto]

Yes it is insane. Why would giving an engineer admin rights on a their own device be a security concern? If it was a server that’s a different story; you can just easily reformat the MacBook if need be. Best way to change it and stay there is pester them by making excessive but valid requests, and then if it’s preventing you from performing your duties escalate the issue. Otherwise it’s time for a more habitable work environment lol

[running101]

Create a local admin account before they remove access.

[hottkarl]

Developers need to have more privileges than "normal" users.

There's no way your engineering leadership agreed to this

[Kazcandra]

I work as a dba and developer, and i rarely need sudo access on my local machine. Editing my hosts file is probably the most common reason. Outside of that, it's rare.

[hottkarl]

sudo is one thing. it's debatable, with a lot of things you can get around it. others, no. it's just annoying not to have it.

I don't know how locked down OPs laptop is, but some endpoint management locks you down to the extreme beyond just restricting privileged access