Centralizing SUDO

[kumar.s]

Admins.

Please bear with a fnky question .

I have a requirement to centralize sudo permissions and the logs similar to power broker .

All the User permissions needs to be there on a HPUX single server ( which must act like sudo server ). all the other servers ( HPUX Servers ) needs to refer the master server to check whether the user has required access for any commands .
and all the logs needs to be logged to centralized location.

Kindly let me know whether the solution with sudo is possible , If possible let me know how it is being configured .

thanks in advance

[F Verschuren]

the easy way:
please the sudoers file on a nfs share.
ore ssp the sudoers file to a lokal please.
The last is relayebler because if you centralizing a single network porblem can cause problems on all you systems:
so if you scp the sudoers file to all servers every ? ours... you have the less impackt if the netwerk ore sentral server failes...

[kumar.s]

Currently I have sudoers file in each Server .

I would like to place the sudoers file in one single servers where i can make changes / invoke , revoke access to users from one singe server and the permission should get reflected on the client machines accordingly .

And also is there any way of having centralized location of sudo logs on perserver basis .

[Ivan Krastev]

You can use rsync to distribute sudoers file. This will skip problems, related to NFS.

regards,
ivan

[Geoff Wild]

And if you have money - have a look at ServerControl from Foxt - it centrally manages your entire Unix access - including sudo like functions - except theirs is called suexec.

http://www.foxt.com/new-itc/products_server.htm

Rgds...Geoff

[Ivan Krastev]

For remote logging chage syslog configuration on each server to send sudo entries to central syslog server.

regards,
ivan

[F Verschuren]

remote logging can be done "easaly" by adding a @hostsname to the syslog.conf,
be aware that the hp syslog will not encript over the network if you want this syslog ng must be installed...

[blah2blah · Accepted solution]

you can use sudo's ldap features to centralize user permissions:
http://www.gratisoft.us/sudo/readme_ldap.html

[kumar.s]

Hi All .

Thanks for the responses.

The question here is on all the hosts it has different usernames groups and UIDS .

so how do i configure on on master server and permissions based on per server/user basis .

if you have any docs online configuring it to be centralized will be use full

[blah2blah]

http://fci.wikia.com/wiki/Setting_Up_A_Centralised_Authentication_Server_With_Sudo_Access_Using_LDAP

[Kevin Wright]

use Host aliases in the sudoers file