Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Once upon a time I set about getting a Linux server to use our Active Directory for logins, and I got it so that I could login as myself and then work on the server, and SU to root to make system changes using the server's local root password.

However, part of the plan we wanted was to not have separate root accounts on every server with passwords which need tracking and updating.

What's a way around this? Can root be a centralised AD account like a Windows Administrator account? Can non-root users be given root permissions in a way that isn't a bodge?

share|improve this question
up vote 4 down vote accepted

You can create root privileges based on LDAP groups using sudo (see the manual for examples). You can even store your sudo configuration within LDAP.

See this question.

share|improve this answer
Keeping the sudo config in LDAP could look daunting to some users. An alternative is to create an "admins" group in LDAP and add this group to the /etc/sudoers file in your servers (similar to the local "wheel" group) – XCondE Oct 24 '10 at 1:22

Something to consider, though, is how you would be able to perform system maintenance and/or recovery. (At this point LDAP/AD services are not yet running on the local system, so root would not be able to authenticate.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.