topic distributed administration in Operating System - Linux

distributed administration

joseph wholey — Fri, 26 Jan 2007 12:23:00 GMT

Not sure if this is the right place to post...
With the advent of security audits and the requirement of "no remote root login" in the enterprise environment, how are most people distributing config files (when needed) "wholesale" to their distributed environments?

Re: distributed administration

Ivan Ferreira — Fri, 26 Jan 2007 14:03:27 GMT

This could be a problem. Try to use centralized environments, like LDAP, so individual configuration files should not be replaced very often.

Depending of your network, for applications configuration files you could use NFS.

When I have to update configuration files in my servers, I just tar the files, transfer the files with my account, logon on each server with my account and use sudo to untar the configuration files.

Using root account with public keys could be acceptable.

Some people use rdisk, you can see a description of its usage here:

http://www.sunmanagers.org/archives/1997/1190.html

Re: distributed administration

Alexander Chuzhoy — Fri, 26 Jan 2007 15:02:24 GMT

You can define 1 machine to be a central distributor of config files. This machine's root's ssh keys (the content of /root/.ssh/id_dsa.pub file) should be placed in /root/.ssh/autorized_keys on all machines where you wish to ditribute the config files.
Now you can use various tools to help you with distribution.
I would suggest the rdist utility (man rdist) and the cfengine (http://www.cfengine.org/). The cfengine is a very powerfull tool. It'll take you sometime to understand how it works, but from then the distribution/automation will become a painless procedure...

Re: distributed administration

Ragu_3 — Mon, 29 Jan 2007 04:54:57 GMT

Almost all machines these days have "ssh" installed on them from a security point of view. Use "scp" to copy files onto other machines/distributed computers.