You basically have 2 options.
- Use the local authentication system of each machine, and push out credential changes to all of them.
- Use a centralized authentication server.
1. Synchronized local authentication
There are multiple products which accomplish this easily. Puppet, Chef, Ansible, and Salt are a few of the more common ones. All these tools fall under what is known as "Configuration Management".
Basically you would have a repository in which you define your authentication credentials as code. The "code" would be as simple as a directive which specifies the username, and hashed password. You'd then sync this code out to all your machines, and run whatever CM tool you chose. The CM tool would then update the local authentication credentials of each user (also creating the user if necessary).
Since you said you want to do other types of configuration as well, this might be the more appropriate solution.
2. Centralized authentication
The most common form of centralized authentication is LDAP. Running an LDAP server might seem daunting, but there are some good packaged solutions such as FreeIPA which make it easily manageable.
Now one of your first thoughts might be: "I want authentication to work even if the central server is down". This is easily accomplished by using SSSD. When a user first logs into a server, SSSD consults LDAP (or kerberos if employed), and if the credentials are valid, it caches them on the local machine. If the LDAP server is not available, it falls back to using its cache. Thus as long as a user has logged in once, they will be able to continue to log in if LDAP is unavailable.
3. Combination of the two
You could also use a combination of the two solutions. This is very common in large scale enterprise environments, but can be employed small scale as well. Basically you'd have a centralized authentication server, and you would use a CM tool to configure the clients to use it.