Non-Root/Role Based Admin

[Scot Sroka]

Hello.

Other than SCM, sudo, runas, uid=0, and restricted sam, what software and/or methods exist to allow non-root/role based administration?

In your opinion, what is the best option (including the above)?

Thanks for your help.

[Pete Randall]

You've pretty well covered the options that I'm aware of. The best option really depends on the circumstances and what you're trying to accomplish. I would guess that a combination of sudo and restricted SAM should pretty much cover anything, but SCM could be helpful, too.


Pete

[Patrick Wallek]

I agree with Pete in that you've covered the options available pretty well.

I like sudo and restricted sam where applicable as well.

[Ravi_8]

Hi,

You have covered all available methods.

In my opinion sudo is the best option to provide non root based admin

[John Payne_2]

The only thing you did not list was CA's eTrust products. (admin/access control) They are not cheap. The role based stuff is pretty much like sudo, repackaged and pretty. (It is good for if you have alot of servers with alot of users to manage, though.)

If you only have a few servers or aren't trying to manage permissions for 200+ users with 10+ different permission levels, use sudo. Otherwise, that's all you will do for months until everyone's happy. (I would definitely use sudo if you are only talking about a few different groups with relatively few special permissions.) Make sure you do not allow 'su su root' in your sudo, so you don't defeat your point...

Hope it helps.

John

[Rita C Workman]

I use restricted SAM...and PowerBroker (third party vendor).

Rgrds,
Rita