As system admin i decided not to give shell access to users and even application admins on production systems.
I give them access via a simple (menu)webpage and the menus are suid capable.
So, even root commands can be granted to someones menu.
I like the fact that no commandline trying or messups with parms are possible.
Our security managers are happy the data is protected that well. Because the application admin could see/change data with its cridentials.
Offcourse when there are major problems, shell access might be needed. But most of then time you can manage with the menus.
Am i the only one?
If not what tools do you use?
Fjd.