topic Centralizing SUDO in Operating System - HP-UX

Centralizing SUDO

kumar.s — Tue, 04 Dec 2007 14:19:06 GMT

Admins.

Please bear with a fnky question .

I have a requirement to centralize sudo permissions and the logs similar to power broker .

All the User permissions needs to be there on a HPUX single server ( which must act like sudo server ). all the other servers ( HPUX Servers ) needs to refer the master server to check whether the user has required access for any commands .
and all the logs needs to be logged to centralized location.

Kindly let me know whether the solution with sudo is possible , If possible let me know how it is being configured .

thanks in advance

Re: Centralizing SUDO

F Verschuren — Tue, 04 Dec 2007 14:24:08 GMT

the easy way:
please the sudoers file on a nfs share.
ore ssp the sudoers file to a lokal please.
The last is relayebler because if you centralizing a single network porblem can cause problems on all you systems:
so if you scp the sudoers file to all servers every ? ours... you have the less impackt if the netwerk ore sentral server failes...

Re: Centralizing SUDO

kumar.s — Tue, 04 Dec 2007 14:29:26 GMT

Currently I have sudoers file in each Server .

I would like to place the sudoers file in one single servers where i can make changes / invoke , revoke access to users from one singe server and the permission should get reflected on the client machines accordingly .

And also is there any way of having centralized location of sudo logs on perserver basis .

Re: Centralizing SUDO

Ivan Krastev — Tue, 04 Dec 2007 14:30:31 GMT

You can use rsync to distribute sudoers file. This will skip problems, related to NFS.

regards,
ivan

Re: Centralizing SUDO

Geoff Wild — Tue, 04 Dec 2007 14:38:53 GMT

And if you have money - have a look at ServerControl from Foxt - it centrally manages your entire Unix access - including sudo like functions - except theirs is called suexec.

http://www.foxt.com/new-itc/products_server.htm

Rgds...Geoff

Re: Centralizing SUDO

Ivan Krastev — Tue, 04 Dec 2007 14:39:47 GMT

For remote logging chage syslog configuration on each server to send sudo entries to central syslog server.

regards,
ivan

Re: Centralizing SUDO

F Verschuren — Tue, 04 Dec 2007 14:47:31 GMT

remote logging can be done "easaly" by adding a @hostsname to the syslog.conf,
be aware that the hp syslog will not encript over the network if you want this syslog ng must be installed...

Re: Centralizing SUDO

blah2blah — Tue, 04 Dec 2007 14:55:15 GMT

you can use sudo's ldap features to centralize user permissions:
http://www.gratisoft.us/sudo/readme_ldap.html

Re: Centralizing SUDO

kumar.s — Tue, 04 Dec 2007 15:01:52 GMT

Hi All .

Thanks for the responses.

The question here is on all the hosts it has different usernames groups and UIDS .

so how do i configure on on master server and permissions based on per server/user basis .

if you have any docs online configuring it to be centralized will be use full

Re: Centralizing SUDO

blah2blah — Tue, 04 Dec 2007 17:15:58 GMT

http://fci.wikia.com/wiki/Setting_Up_A_Centralised_Authentication_Server_With_Sudo_Access_Using_LDAP

Re: Centralizing SUDO

Kevin Wright — Tue, 04 Dec 2007 19:11:54 GMT

use Host aliases in the sudoers file