I'm working in a mixed team of Sysadmins who are merging a bunch of > subsidiaries into one central IT organization. I'm looking > proactively for a better way to manage credentials and such and ran > across this article. What do people think? > > > http://www.linuxjournal.com/content/sharing-admin-privileges-many-hosts-securely >
This seems labor intensive to me and not very scalable, particularly having to perform actions on reboot (too many kernel fixes recently). For a smaller, manually managed environment, the solution seems to work. You would need more Joe users, though, and retiring those doesn't seem part of the plan. We describe our sysadmin accounts in Puppet, using a configuration "module" that takes care of user account, home directory, authorized_keys files and (configurable) sudo permissions. Only the password hash is stored, so their password remain a secret. Every person has his own SSH keypair and password authentication is disabled everywhere. Still, only a few bastion nodes are directly accessible from the outside. We don't like to authorize individual users for a resource, so we use groups to identify teams. Whenever someone leaves, we change the password hash on the Puppet master(s) to *LK* and have the user's authorized_keys removed from all systems. The actual user account is never removed to prevent UID recycling, but there may be better solutions for this problem. Hans
_______________________________________________ Tech mailing list Tech@lists.lopsa.org https://lists.lopsa.org/cgi-bin/mailman/listinfo/tech This list provided by the League of Professional System Administrators http://lopsa.org/
