Our lab consists of multiple desktop machines and a data node, all running Ubuntu Linux. The desktop machines mount /home from the data node. Files and users in /home are managed using UIDs and GIDs stored in the data machine's /etc/passwd, /etc/group, and /etc/shadow. If I want to add a user or a group, I have to edit the data machine's passwd/group/shadow files and copy the specific lines around to all the desktop machines' passwd/group/shadow files.
Is there a way to make Linux use multiple passwd/group/shadow files? We want the desktop machines to have their own passwd/group/shadow and then include passwd/group/shadow from the data machine as an addition to their own.
Also, is there a way to give users sudo access but not allow them to modify passwd/group/shadow to give them access to files and groups? We want them to do administrative tasks (install software, setup network/printers etc.) but we also want to tightly control who has access to specific data.