We have multiple Linux servers that authenticate to an Active Directory Domain. For a group in AD, I want to add a list of commands that are allowed to run as root using sudo. I can obviously ssh-in to each computer and update sudoers file -but that will take some time. Also, root login is not allowed. So, password less logins will only work for non-root users.
Is there a quick way to update the sudoers file for each Linux computer at once? I am thinking of a Perl or Python script with some system administration abilities here.
Update: Thanks veroteq7 and Shane Madden. I had thought about deploying cfengine at one point- but we don't have it running currently. We have decided that using LDAP would be the best solution. I am getting an error importing the LDIF schema schema.ActiveDirectory for sudo. The error is "parameter is not correct" on line 144.
This is the content from line 144 onwards:
dn: CN=sudoRole,CN=Schema,CN=Configuration,DC=X changetype: add objectClass: top objectClass: classSchema cn: sudoRole distinguishedName: CN=sudoRole,CN=Schema,CN=Configuration,DC=X instanceType: 4 possSuperiors: container possSuperiors: top subClassOf: top governsID: 126.96.36.199.4.1.159188.8.131.52 mayContain: sudoCommand mayContain: sudoHost mayContain: sudoOption mayContain: sudoRunAs mayContain: sudoRunAsUser mayContain: sudoRunAsGroup mayContain: sudoUser rDNAttID: cn showInAdvancedViewOnly: FALSE adminDisplayName: sudoRole adminDescription: Sudoer Entries objectClassCategory: 1 lDAPDisplayName: sudoRole name: sudoRole schemaIDGUID:: SQn432lnZ0+ukbdh3+gN3w== systemOnly: FALSE objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,DC=X defaultObjectCategory: CN=sudoRole,CN=Schema,CN=Configuration,DC=X
The command that I used is:
ldifde -i -f schema.ActiveDirectory -c dc=X dc=DOMAINNAME,dc=LOCAL
Update2: I created a new question. Thanks everybody for suggestions.