Unfortunately the infrastructure I work in has static root passwords that are very rarely refreshed. So people leaving the company will have our root passwords and it can potentially be leaked to others inside the organization.
So with that problem stated, what is the best method of executing a password refresh policy on linux/unix platforms?
If it's the modification of the sudoers files on each host and disabling root passwords, how do you manage these sudoers files and keep everything up to date and consistent?
If it's just using root keys, what can be done to protect/refresh these keys on a regular basis?
Basically, how are others using tools to perform regular refreshes to ensure security?