In my lab, a group of people work each at one workstation, and they share a number of drives over NFS. They run shared software residing in one of those NFS drive and they run it on the NFS drives where the data is.
The current set up has all of them using the same user account, let's call it
one on all hosts. Lab members log in as
joe@myhost to have a desktop with their own customizations, but for any real work on the scientific data, which belongs to
users, they must become
Note that some per-user customization of the environment is achieved by having
one accounts defined host-specific and thus have their home directory local i.e.
one@myhost:/home/one (they all are UID 502 and GID 100 for historic reasons). So each user's
one account can have specific environment variables set alongside the common
PATH pointing at the shared programs.
There is currently a debate going on in the lab where I am suggesting that it is better practice in Unix to have separate accounts for separate users and replicate the current functionality of a single user by using groups.
I have listed the following disadvantages of the single account
- difficulty managing several software versions,
- almost meaningless auditing/logging,
- everybody can delete everybody's else's files and programs,
- when one member leaves the lab, ideally passwords should be changed
Now, this network is behind a firewall and it is just scientific data that would be meaningless to an intruder and has no economic value. Plus everything is secondary to productivity in a fast-paced scientific lab, including security. Since the data is frequently backed up, the ability to delete data or programs is also not a major concern.
one account approach is very convenient and was established many years ago (2001?), I am having difficulty to convince anybody to go to one account per user. Perhaps I am using the wrong arguments, or perhaps maybe the scenario I just described above is such that the
one approach is a practical middle-ground, and I am being inflexible in my reasoning.
In either case, I would appreciate if you can help me find out if I am in the wrong, or if I am right, suggest how I could otherwise argue my case.