Update RHEL servers through ssh, without root ssh access

Question

Where I currently am I have a requirement to set PermitRootLogin to no for ssh.

I would like to update all of my severs at the same time with passwordless login, however without the root account enabled is there a way to do this?

Answer 1

Create a script on the server that handles your updates, then configure it in /etc/sudoers to allow it to be executed without a password.

User_Alias UPDATEADMINS = user1, user2
Cmnd_Alias UPDATECMDS = /usr/local/bin/updatescript1, /usr/local/bin/updatescript2
Host_Alias UPDATEHOSTS = 10.10.1.0/24
UPDATEADMINS UPDATEHOSTS = NOPASSWD: UPDATECMDS

Obviously make sure the update scripts don't have access to anyone but root. You can then setup SSH keys for your update users and execute it remotely via SSH:

$ ssh user1@10.10.2.2 sudo /usr/local/bin/updatescript
root

In that example, updatescript simply echoes output of whoami. If your script requires input it is extremely important to understand the security implications, and to properly sanitize that input.

Answer 2

Set PermitRootLogin to without-password. Then, install a tool like clusterssh. That way you can manually update all servers simultaneously.

Or, you can invest in implementing puppet, which makes it easy to make sure everything is always identical on all servers (meaning you can have updates installed at a certain time on all machines simultaneously) and doesn't require a root login. Does require some time to setup though.

Answer 3

ssh in with any user... from there... either su to root... or setup that user as a "sudoer" and sudo yum update.