2

Unfortunately the infrastructure I work in has static root passwords that are very rarely refreshed. So people leaving the company will have our root passwords and it can potentially be leaked to others inside the organization.

So with that problem stated, what is the best method of executing a password refresh policy on linux/unix platforms?

If it's the modification of the sudoers files on each host and disabling root passwords, how do you manage these sudoers files and keep everything up to date and consistent?

If it's just using root keys, what can be done to protect/refresh these keys on a regular basis?

Basically, how are others using tools to perform regular refreshes to ensure security?

3

I think you are looking using the wrong focus. Is desirable that every and each of those employees has their own account with their own password and the accounts being disabled/destroyed when they leave (you can disable root at this point). Use some centralized system to manage the accounts of all clients and set each user privileges, based on groups or users.

If it's the modification of the sudoers files on each host and disabling root passwords, how do you manage these sudoers files and keep everything up to date and consistent?

Use a centralized account management, like LDAP.

If it's just using root keys, what can be done to protect/refresh these keys on a regular basis?

If you follow the above, I think this will not be necessary anymore, right?

how are others using tools to perform regular refreshes to ensure security?

Maybe you should starting to write a security policy for your specific environment. There are several advices that maybe won't apply to your specific environment. The centralized authentication may cause more headaches than it solves, but for me seems like the more sane solution.

  • What centralized solution do you recommend? Just ldap? Any other solutions you've had success with. Configuration management utilities? – rainereality May 9 '14 at 2:02
  • @rainereality I personally think the arguably best solution is FreeIPA. It's a very advanced LDAP server with support for Kerberos, SSH keys, and a lot more. It has just about every bell and whistle you could want, and it's fairly easy to work with. – Patrick May 9 '14 at 4:34
  • How do you handle multiple root user accounts? Some machines you may not want to have the same root user password in LDAP. Also, if you disable root account what happens if you lose LDAP connectivity? How can you still access the machine? – rainereality May 15 '14 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.