Passwd total management

[Lee Tae-kyung]

Hi~~
Nice to meet you in net!
I want to do the total management of root's passwd in many unix systems.
It is difficult for me to change root's passwd with about 50 unix systems-HP,Sun-.

Please, help me....

Sincerely yours

[Pete Randall]

Basically, I see 4 choices available to you.

1) Implement NIS or NIS+ - it can be complex and hard to administer but it's a proven solution used widely.

2) Enable rcp/remsh functionality and write a simple script to propagate passwd files to all the servers. This approach has the inherent security flaw of utilizing the "r" commands.

3) Delegate responsibility to others through sudo or restricted SAM.

4) Continue as you have been.


Pete

[Ross Zubritski]

How about LDAP?

Regards,

RZ

[Lee Tae-kyung]

Thanks for your answers...
I thinked above solutions.
But, Above solutions are complex and have a little problem.
So, In the concrete I want to access this problem with shell script.

Did anyone experience this problem?

Sincerely yours...^^

[Ross Zubritski]

It can be done with shell, however, to Pete's point get rid of the dreaded "R" commands. Use secure shell.

Regards,

RZ

[S.K. Chan]

We had NIS running which centralizes the user account management however since root account resides locally on the each client machine, we had a process to update the local passwd file everytime the root password changes quarterly. The mechanism that we use to update the password files is just plain shell script I think. In your case if you do not want to implement NIS you can consider using rsync (which is a file transfer/synchronization tool that we use to synchronizes some other files across the network). Along with that if you want to use this tool ssh is recommended for added security. Take a look at this example on how this can be achieve.
http://www.unixadm.net/howto/rsync-ssh.html

[Lee Tae-kyung]

Thanks for your answer.
But rsync command is used when the passwd files of our servers is same.
Our passwd files of servers is not same.

Best regards~~

[S.K. Chan · Accepted solution]

It sounds like a script solution is what you're looking for. Take a close look at Robin's script in this thread. It may be just what you need. You want to make sure you test it thoroughly before implementing it since you got non-HP boxes.
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xbdb6cf38d6bdd5118ff10090279cd0f9,00.html
Hope this help ..

[Steven E. Protter]

Two suggestions:

1) LDAP, then your users will be authenticatec by your network primary domain controller(PDC).

This still leaves you with 50 root passwords to deal with.

I don't like NIS, but thats a personal problem. Next, I'd susggest ssh which replaces remesh/rcp. After exchanging public keys, you only need to regularly remember the root password to one system then ssh nextsystemname and you're there no passsword.

below is a link to the software and attached is Chris Vales' guide to generating and exchanging public keys.

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=T1471AA

SEP

[Lee Tae-kyung]

Thanks for S.K answers...
I did.


Have a good day~~