network shared /etc/sudoers
Par Benoît Dejean le jeudi, 15 mai 2008, 10:01 - Lien permanent
I'd like to use the same/etc/sudoers file for a lot of servers. sudo seems to support this because it has Host_Alias. What's the best way to share the same file ?
- the path to /etc/sudoers seems to be hardcoded, so i can't put it on a network fs.
- i haven't find any ldap support
- scp the file to all the hosts ?
Any experience in that ? Thanks.
Commentaires
We have the same kind of problem where I work (a web app that needs deploying to 15 servers).
We solved it using rsync over ssh (scp would work for you) and expect to enter the password.
What about making it a symlink to a file on some shared directory?
You could bind mount /etc/sudoers to your network location (or use a symlink)
1) Use something to distribute the sudoers file; cfengine or puppet come to mind first,
2) Store sudo's configuration in LDAP server
I'd advise against any network-based mounts.
Further to Welsh Dwarf's comment above, I would suggest using key-based authentication with ssh rather than passwords. (Just make sure you are protected against Debian's recent ssh key security bug
Your (secure) options are effectively:
Every other option is pretty bad, keeping in mind that the file is chmod 600 for a reason.
LDAP is the way to go. Here's an howto:
http://fci.wikia.com/wiki/Setting_U...
Very nice howto thanks.
I'll have a look at cfengine/puppet but that may be harder to setup because there are too many different OS to handle. I didn't know of these tools, they look awesome ! Puppet looks much more modern and documented. Thank you very much.
I've used scp with keys quite successfully for this (and many other things) in the past.
Cfengine and Puppet are designed to handle OSes. This is a great way to manage all your machines.
We deal with a similar issue at my company, only it's more like 6000 servers. I'm not an expert in this arena, but I'm pretty sure our solution involves a shell script that is run nightly via cron. We keep all of the standard configs like ssh, apache, sudoers, /root/.ssh/authorized_keys, etc in a CVS repository. So the script just has to update it's checkout, then rsync it over to /.
One way would be to copy with rsync/scp like other people suggested. Another way is to use a template file to copy around and then generate the actual /etc/sudoers on each machine with a common script, which could do some checks and local substitutions.
csync2 !