how do you manage servers' root passwords

Question

In our administration team, everyone knows root passwords for all client server but what we do , if one of the team is not still working with us he has still our passwords

and we have to change them all, every time someone leave us ,

now we are using ssh keys, unstead of passwords, but this is not helpful if we have to do something other than ssh.

Answer 1

The systems I run have a sudo-only policy. i.e., the root password is * (disabled), and people have to use sudo to get root access. You can then edit your sudoers file to grant/revoke people's access. It's very granular, and has lots of configurability---but has sensible defaults, so it won't take you long to set up.

Answer 2

While it is a good idea to use a sudo only policy like Chris suggested depending on the the size of your system an ldap approach may also be helpful. We complement that by a file that contains all the root passwords but the root passwords are really long and unmemorable. While that may be considered a security flaw it allows us to still log in if the ldap server is down.

Answer 3

If you have ssh access via your certificates, can't you log in via ssh and change the root password via passwd or sudo passwd when you need to do something else that requires the password?

Answer 4

We use the sudo only policy where I work, but root passwords are still kept. The root passwords are only available to a select few employees. We have a program called Password Manager Pro that stores all of our passwords, and can provide password audits as well. This allows us to go back and see what passwords have been accessed by which users. Thus, we're able to only change the passwords that actually need to be changed.

Answer 5

Aside from the sudo policy, which is probably better, there is no reason why each admin couldn't have their own account with UID 0, but named differently, with a different password and even different home directory. Just remove their account when they're gone.

Answer 6

We just made it really easy to change the root passwords on every machine we admininster so when people left we just ran the script. I know not very savvy but it worked. Before my time, everyone in the company had access to root on all server. luckily we moved away from that.

Answer 7

Generally speaking, if someone leaves our team, we don't bother changing root passwords. Either they left the company (and have no way to access the machines anymore as their VPN has been revoked, as has their badge access to the building, and their wireless access to the network), or they're in another department inside the company and have the professionalism to not screw with our environment.

Is it a security hole? Maybe. But, really, if they wanted to screw with our environment, they would have done so prior to moving on.

So far, anyone leaving the team who wants to gain access to our machines again has always asked permission, even though they could get on without the permission. I don't see any reason to impede our ability to get work done, i.e., no reason to believe anyone else moving onwards and upwards would do differently.

Answer 8

Reasonably strong root password. Different on each box. No remote root logins, and no passwords for logins, only keys.

Answer 9

I would normally suggest the following:

1. Use a blank root password.
2. Disable telnet
3. Set ssh for no-root-login (or root login by public key only)
4. Disable su to root by adding this to the top of /etc/suauth: 'root:ALL:DENY'
5. Enable secure tty for root login on console only (tty1-tty8)
6. Use sudo for normal root access

Now then, with this setting, all users must use sudo for remote admin, but when the system is seriously messed up, there is no hunting for the root password to unlock the console.

EDIT: other system administration tools that provide their own logins will also need adjusting.