<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Jerrad,<br>
<br>
Yes, but you can keep them out of other accounts by removing so
many global privileges and making them "Queue-level" privileges. That
way, no one can get into a Queue unless specifically allowed to by
privileges.<br>
<br>
Kenn<br>
LBNL<br>
<br>
On 6/18/2009 8:31 AM, Jerrad Pierce wrote:
<blockquote
cite="mid:be7163f0906180831h672c03b4wfc4bad9b23624503@mail.gmail.com"
type="cite">
<pre wrap="">On Thu, Jun 18, 2009 at 11:27, Ken Crocker<a class="moz-txt-link-rfc2396E" href="mailto:kfcrocker@lbl.gov"><kfcrocker@lbl.gov></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap=""> Why is it a security issue? If your privileges are allowing them to
go to a user "Preferences", then I understand, but to just know what
UserIds are on the system doesn't seem like a big deal to me.
</pre>
</blockquote>
<pre wrap=""><!---->It gives them in a edge into trying to crack other accounts, because
they then already have half the authentication pair. On the other hand,
they can already determine the name of a privileged user by looking at
who owns their ticket or otherwise converse with them via RT.
</pre>
</blockquote>
</body>
</html>