1

Where I work, we have very light security policy which allows users to connect to their personal mail accounts and so on.

Every user is root on his own computer and there is no centralized account management. It's pretty much like all computers where standalone/personal computers on the same local area network.

The only exception is that the sys-admins demand that we put a key in our /root/.ssh/authorized_keys so they can backup our files. Fair enough, except that I'm a bit paranoid.

I have nothing against having mandatory backups (I even agree it is a good thing) but on some occasion, I plug my personal ciphered usb key that contains my personal password database (keepass) and I'd like to avoid that its content gets backuped.

So here is my question:

Is there a way for me to automatically unmount the USB key volume or even better: to delay the root login from an external host until my usb key is unmounted/plugged ?

What would be the easiest/safest way to do that ?

Note: My employer actually agrees with this setup.

Note #2: Reading the comments, I would say I now understand what is wrong in asking that, and how it could seem I'm trying to piss my sysadmin. I can't blame anyone for not trusting me of course, and I sincerely want to apologize if at any point I made it sound like I was "smarter than the sysadmin" or anything. This question expected a purely technical answer but a purely technical answer would not have been a good answer. As they say: "Science without conscience is but the ruin of the soul..." Thanks to you all for your feedback.

Improve this question
9
  • 3
    The core question is who owns the computer? If the computer is owned by your employer you may not be standing on very firm ground to limit IT's access. Also consider this, backups are for your protection, if you put something in place to prevent centralized backups and something goes wrong, oh well right? Not quote so if you also lost many hours of deliverables (work).
    – Red Tux
    Oct 10, 2012 at 16:01
  • Ok, ignoring the fact that this type of setup is absolutely insane, this question is off-topic and doesn't exactly fit within the scope of this site as outlined in our faq.
    – MDMarra
    Oct 10, 2012 at 16:01
  • @MDMarra: I read the FAQ but I admit I fail to see where I violate the conditions of acceptance. Does my question really fall to the "system misuse case" when my employer explicitely gives his permission for this setup ?
    – ereOn
    Oct 10, 2012 at 16:08
  • 1
    This site is also not for end user questions, so regardless of the whys and wherefores the question remains off topic.
    – John Gardeniers
    Oct 10, 2012 at 16:47
  • 1
    The answer to your question is simple: Contact your system administrator, and request that USB media be exempted from the backup of your workstation. If your company is truly OK with you having personal devices connected to your workstation they should not mind ignoring them during backups (in fact for space and liability reasons they probably don't want to back up your data...)
    – voretaq7
    Oct 10, 2012 at 20:45

2 Answers 2

Reset to default
8

The best way to keep your employer from your "personal" data is to keep your personal data off your employer's computer. Period.

Improve this answer
14
  • 1
    +1 Works perfectly every time!
    – Dave M
    Oct 10, 2012 at 16:06
  • That sure is the best way. My employer allows me to connect to my personal accounts using a company computer and even agrees not to backup my password database. I'm actually asking how to do it, not if I'm allowed to. I can understand how this can seem insane to sysadmins. Fair enough. But can't I take advantage of the extra permissions I was given by my employer ?
    – ereOn
    Oct 10, 2012 at 16:09
  • @ereOn - walk into a police station and ask them for safe-cracking tips - see how you get on ;)
    – Chopper3
    Oct 10, 2012 at 16:13
  • 1
    If your employer has given you permission to do this, then ask your company's sysadmins to help you. If they have trouble, send them here :-)
    – mfinni
    Oct 10, 2012 at 16:17
  • 1
    ereOn - it's not a matter of honesty. Think of it this way - your sysadmin, the one who is paid to fix your problems, doesn't want to spend any time on this issue because it's not work-related. We do the same job as that guy, and we're not paid for the answers we give on this site. Until you explained that this was cool with your employer, this sounded like an attempted subversion of policy. Thus, no good answers from us for that.
    – mfinni
    Oct 10, 2012 at 16:20
1

The best way is to mount the key in a place in the filesystem that isn't already backed up. I assume they're not backing up /, /tmp, etc. Find out what they are backing up, and then mount the drive elsewhere.

Improve this answer
1
  • Mounting it in /tmp is a very good idea. Thanks. I accepted the first answer for ethical reasons which I explained in the question, but upvoted this one for fairness.
    – ereOn
    Oct 10, 2012 at 16:47

Not the answer you're looking for? Browse other questions tagged .