Administrator (sudo) rights in Cubbli Linux

About

You can receive administrator rights to your University Cubbli Linux desktop computer or laptop. Currently this is achieved by adding your user account to a local sudo group on the local computer, so that you can access the root user account with your own password. 

Alternatively, sudo access can be granted to a centrally managed active directory IDM group. 

University degree students

 
When you have read and accepted all the conditions listed under Mandatory reading regarding acquirement of sudo-rights, Administrative privileges, Confidentiality agreement and the Cooperation agreement in information technology, you can run the command i-want-sudo-access on your Cubbli first-year student laptop. The correct answer to the question Do you still want sudo access rights, even after familiarizing yourself with and agreeing to the conditions? is Yes I do. 

University staff

 
Once you have read all the necessary conditions for receiving sudo access rights under Mandatory reading regarding acquirement of sudo-rights, Administrative privileges, Confidentiality agreement and Cooperation agreement in information technology, proceed to the Flamma page Applying for and renewing computer administration rights for further instructions. 

Mandatory reading regarding the acquirement of sudo-rights 

• Linux offers almost no protection against mistakes made with admin rights

  • A typo or a wrong command, or just following bad instructions from a web page can destroy your system, make it unbootable or destroy or corrupt your files. 
• If you break your system with your admin rights, the University IT-Helpdesk probably can't help you
  •  Debugging a broken Linux installation takes lots of time and effort, which would probably better be used elsewhere. Most likely we will fix your broken Linux computer by reinstalling it from scratch.  
• Do not run programs as root! This is the most common mistake users make
  •  If you try to run a web browser or any other GUI program as root, it will overwrite files in your home directory with files owned by root and your desktop will stop working. It is also likely that the program will write files in system directories. Non-GUI-programs can also do this. If a software can't function because of missing access rights, fix the access rights of the accessed resource.  
• Use the root account only for administrative purposes 
  • Use the root account only for necessary actions such as installing software from software repositories. Do not use a root account to run server software! If a server application needs elevated privileges to start, it should still run under its own dedicated, unprivileged user account rather than as root. 

• Do not remove the Cubbli packages
  •  Even if apt dependency resolver asks for it, do not remove Cubbli packages! The University configuration is implemented by those packages, and it will stop working if they are removed. 
  • It is probably safe to remove cubbli-apps, cubbli-dev and cubbli-extra packages if you need space on the root file system. 
• Do not use ‘do-release-upgrade’ to upgrade to a newer distribution version
  • The do-release-upgrade command will not work with Cubbli and it will break your system, probably leading to a complete reinstallation. Your files can still be saved though. Instead of running this command yourself, ask IT-Helpdesk to run the upgrade. The upgrade can be run remotely when the computer is connected to the University network via wired connection, and it takes much less time than running the do-release-upgrade command.  

• The root partition and root directory are intentionally small 
  • Any important or large data should be saved to the /home/ partition. If you use docker images, databases or virtual computers, configure them to save data on the /home/ partition.
  • If the root partition fills up, the Linux installation will no longer work properly.
  • Only files in the /home/ partition will be copied to a new installation or preserved during reinstall.  
  • If you need Docker, use cubbli-docker package: $ sudo apt install cubbli-docker
• Be careful and selective when configuring 3rd party software repositories
  • If you add a 3rd party repository to a Cubbli host, always add the GPG key, too. The GPG key is used to sign the installed software packages.
  • Also, apt repositories provide no protection against malicious or buggy packages: they can break your system, the repositories will have root access to your host (and your data!) and they can stop automatic installation of security updates if there are any problems.  
• Consider the privacy of other users
  • If there are other users using the same computer, the root account can access everything that the other users can, including files, kerberos tickets, web browser cookies, keyboard and mice events, network traffic and the screen. There is no way around this, which means that root access can only be given to a computer where there is only one user, or to a group where everybody knows that this is the case.  
• You don't need root rights to install, compile or develop software
  • Software can be installed and run from your own home directory, including binary libraries and daemons.
  • Most programming environments for scientific computing provide tools to manage library dependencies without any administrator rights (Python, R, nodejs and probably many others). 
  • If an installer or a compiled software tries to install itself by default to a system directory (like /opt or /usr/local), just change the default install path (you might need to read the manual). This has the added benefit that your development will survive operating system and computer upgrades and can be reproduced later when the original computer doesn't exist anymore. And you can have multiple different environments if you have multiple projects. Use a virtual computer or docker images for development and testing  
  • KVM virtual computers are easy to setup and they can also be easily replaced (or returned from snapshots) if anything goes wrong with them.  
• If software or a library is missing from Cubbli or is obsolete, ask IT Helpdesk to install or upgrade it
  • We mostly don't know about missing software or software dependencies unless someone asks about them. 
• There are plenty of web pages and LLMs with bad advice
  •  If you don't know what the commands you are running actually do, consider not running them.
  • Also don't blindly copy and paste commands straight to the command line, whether it came from a random forum post or an AI chatbot. Run them through a text editor first for added security. 

• The computer needs to be reinstalled before it is given to the next user
  • The Centre for Information Technology specialists do not always know if a computer has changed ownership, so you should always mention user changes to IT Helpdesk.  

Administrative privileges 

Administrative privileges to University of Helsinki computers have been assigned to the Centre for Information Technology’s on-site IT support teams. 

University employees can apply for administrative privileges to a University computer they use. For valid reasons, applicants may be granted administrative privileges to an individual computer for a fixed period. The following are considered valid reasons: 

• Long-term continuous work outside Finland or outside University facilities in Finland 

• Use for field measurements which is comparable to the use of specialised University computers 

• Application development (some restrictions apply) 

• The employee must hold administrative privileges to complete his or her duties, or not holding such privileges causes unreasonable inconvenience to the employee. 

The following are not considered valid reasons: 

• Working from home or outside the opening hours of the University IT Helpdesk 

• Occasional work outside Finland or outside University facilities in Finland 

• Installation of software on the computer in question 

• “Just in case,” “my colleague has these privileges,” or “I can do it myself” 

Applicants for administrative privileges must meet the following conditions: 

• They must agree to follow the University’s information security policy and regulations 

• They must sign the University’s confidentiality agreement (Appendix 1) 

• They must agree to comply with the University’s cooperation principles (Appendix 2) 

Administrative privileges can be granted for a fixed period of up to one year. Extension of these privileges does not require a new application. 

Administrative privileges can be granted to an employee who needs them to perform IT maintenance procedures not included in the support services provided by the Centre for Information Technology and if the employee is clearly unable to complete his or her work duties without administrator status. 

If these privileges are granted, the responsibility for maintaining the University computer will be shared between the Centre for Information Technology and the employee. Employees with administrative privileges to their University computer are entitled to receive support from the University IT Helpdesk, but the Centre for Information Technology may ultimately restrict its support responsibilities to the reinstallation of the University computer. 

If abused, these privileges can also be revoked. Revocation can occur in the following cases: 

• Activities that breach the University’s information security policy and regulations 

• Direct or indirect harm resulting from carelessness or negligence 

• Failure to maintain appropriate IT skills 

• Use of administrator status for purposes other than those described in the original decision 

Administrative privileges to a computer group 

University employees can also apply for administrative privileges to a group of University computers. This may be justified, for example, in some research groups. Administrative privileges to a University computer group must be requested using the same procedure as for individual University work computers (see above). 

As a rule, however, such research groups should use separate laboratory networks. 

CONFIDENTIALITY AGREEMENT

Information obtained during employment or under a contract with the University of Helsinki 

This agreement shall apply to confidential information obtained while employed by the University of Helsinki (UH, as defined below) or while carrying out work pursuant to a contract with the University of Helsinki or as a service provider. In addition to that which follows from my contract of employment or service as well as from other general instructions and legislation related to the employment or contract, I agree to the following with regard to confidential information: 

In this agreement, the following terms have the following meanings: 

“Users” refers to UH employees, students or other persons entitled to use UH information systems. 

“Confidential information” (CI) refers to the business and trade secrets of the UH, its partners and its contracting parties, Users’ personal, salary and other confidential information, Users’ emails and other confidential messages and related content, identification information, messages (e.g., the information generated from Internet, intranet and extranet usage) and geographic information, other information considered confidential by law, information indicated in the UH security classification as confidential or understood to be confidential, information related to UH security arrangements, and all confidential information equivalent to the above, regardless of: 

• The format of the information (electronic, written, oral) 

• The person who disclosed the information 

• Any other source of the information 

“External party” refers to any third party not authorised to obtain or process CI, including employees, contracting parties, representatives, agents and Users of the UH and its partners who are not authorised to process CI pursuant to the duties assigned to or agreed with them or who are not authorised to obtain CI pursuant to their position or role. 

“UH” refers to the University of Helsinki, all those working within it, and its units, cooperative consortia, departments, institutes and faculties. 

When handling or obtaining CI, I agree to keep all CI strictly confidential and: 

• Not to reveal, communicate or disclose CI to any External Party 

• Not to leave CI where External Parties can view or otherwise access it 

• Not to obtain or process CI more extensively than what is necessary within the law to fulfil the obligations of my employment or service contract 

• Not to use CI in a manner unrelated to my work duties or service contract for the benefit of myself or any External Party, and 

• Not to otherwise misuse CI. 

However, the obligation of confidentiality shall not apply to information that: 

• Is publicly available or otherwise public 

• I received from a third party without obligations of confidentiality 

• I had already acquired without obligations of confidentiality prior to receiving it from the University 

• I have independently developed without the use of information obtained from the University or before the University disclosed equivalent information to me 

• Must be published by law or official order 

I agree to take particular care to follow all the regulations, instructions and practices regarding information security which the UH has specified within the limits of its authority. 

At the end of my employment or service contract, I shall promptly transfer to the UH all documents and data media (including any copies) that apply to Users, the UH or its partners, or that contain CI. 

This agreement shall also be valid after the end of my employment or service contract for as long as the CI remains confidential. After the end of their employment, however, UH employees shall be permitted to make a living by using, within the ordinary scope, the general knowledge and experience acquired during their employment at the UH. 

I understand and accept that the UH grants me no rights to CI or any part thereof. 

I understand my obligations under this confidentiality agreement concerning University instructions, legislation, confidentiality and the prohibition of use, and am aware that breach of this agreement may lead to penalties, claims for damages and other consequences related to employment law or contract law. 

This agreement shall be governed by the laws of Finland. 

Disputes arising or relating to this agreement shall be settled primarily by negotiation. If negotiations are unsuccessful, the dispute shall be settled at first instance by the District Court of Helsinki, unless otherwise provided for by mandatory laws. 

COOPERATION AGREEMENT IN INFORMATION TECHNOLOGY 

When maintaining University computers as an administrator, I agree to follow the legislation on information security, the University of Helsinki rules on information security, and its rules on the use and maintenance of information systems. 

I shall comply with the University of Helsinki confidentiality agreement and understand the obligations it places upon me. 

When maintaining University computers as an administrator, I shall follow the instructions and rules issued by the University of Helsinki Centre for Information Technology on the use and maintenance of information systems, shall employ the same maintenance methods and tools as the Centre’s on-site support staff, and shall cooperate with the Centre’s staff. 

I shall maintain the appropriate skills needed for my work duties and the information systems I use, and shall participate in training organised by the University of Helsinki Centre for Information Technology. 

I understand that violating the above undertakings may lead to the restriction or cancellation of the rights granted to me.