Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Where I currently am I have a requirement to set PermitRootLogin to no for ssh.

I would like to update all of my severs at the same time with passwordless login, however without the root account enabled is there a way to do this?

share|improve this question
add comment

3 Answers 3

up vote 2 down vote accepted

Create a script on the server that handles your updates, then configure it in /etc/sudoers to allow it to be executed without a password.

User_Alias UPDATEADMINS = user1, user2
Cmnd_Alias UPDATECMDS = /usr/local/bin/updatescript1, /usr/local/bin/updatescript2
Host_Alias UPDATEHOSTS = 10.10.1.0/24
UPDATEADMINS UPDATEHOSTS = NOPASSWD: UPDATECMDS

Obviously make sure the update scripts don't have access to anyone but root. You can then setup SSH keys for your update users and execute it remotely via SSH:

$ ssh user1@10.10.2.2 sudo /usr/local/bin/updatescript
root

In that example, updatescript simply echoes output of whoami. If your script requires input it is extremely important to understand the security implications, and to properly sanitize that input.

share|improve this answer
add comment

Set PermitRootLogin to without-password. Then, install a tool like clusterssh. That way you can manually update all servers simultaneously.

Or, you can invest in implementing puppet, which makes it easy to make sure everything is always identical on all servers (meaning you can have updates installed at a certain time on all machines simultaneously) and doesn't require a root login. Does require some time to setup though.

share|improve this answer
    
I may have a look at puppet, the only issue I can foresee is if an update fails. Does puppet provide this information or is it just a configuration tool? –  specto Sep 3 '10 at 14:16
    
You can use puppet-dashboard for checking errors –  Mike Sep 3 '10 at 14:35
    
There are puppet reporting tools, but I haven't used them yet. –  wzzrd Sep 3 '10 at 14:37
add comment

ssh in with any user... from there... either su to root... or setup that user as a "sudoer" and sudo yum update.

share|improve this answer
    
This is what I currently do, it's extremely inefficient and I'm trying to get away from it. –  specto Sep 3 '10 at 14:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.