distributed administration

[joseph wholey]

Not sure if this is the right place to post...
With the advent of security audits and the requirement of "no remote root login" in the enterprise environment, how are most people distributing config files (when needed) "wholesale" to their distributed environments?

[Ivan Ferreira · Accepted solution]

This could be a problem. Try to use centralized environments, like LDAP, so individual configuration files should not be replaced very often.

Depending of your network, for applications configuration files you could use NFS.

When I have to update configuration files in my servers, I just tar the files, transfer the files with my account, logon on each server with my account and use sudo to untar the configuration files.

Using root account with public keys could be acceptable.

Some people use rdisk, you can see a description of its usage here:

http://www.sunmanagers.org/archives/1997/1190.html

[Alexander Chuzhoy]

You can define 1 machine to be a central distributor of config files. This machine's root's ssh keys (the content of /root/.ssh/id_dsa.pub file) should be placed in /root/.ssh/autorized_keys on all machines where you wish to ditribute the config files.
Now you can use various tools to help you with distribution.
I would suggest the rdist utility (man rdist) and the cfengine (http://www.cfengine.org/). The cfengine is a very powerfull tool. It'll take you sometime to understand how it works, but from then the distribution/automation will become a painless procedure...

[Ragu_3]

Almost all machines these days have "ssh" installed on them from a security point of view. Use "scp" to copy files onto other machines/distributed computers.