Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am in a typical scenario with my Linux Server. I am pretty sure many others might also be facing similar issues. I want to know how to over come it.

1. We have a 5 Linux servers where we have hosted various websites
2. We keep doing development and these websites are live and code changes need to be deployed everyday
3. We need to allow the employees access via SSH to the server. (Servers hosted with Rackspace)
4. We have our repository setup over Assembla and auto deploy is configured on it
5. We develop most of the websites in PHP and MySQL
6. Since we are a small company and things need to move fast, after a while we share root password for the server with the team members

1. Every time an employee leaves the organization we have to change all the database passwords, ssh password for root, delete accounts, remove all accesses. These activities take a lot of time. Sometimes even 1-2 days. In case the work load is more it may take more time as well (never more than 3 days though). But these 3 days are quite vulnerable. Someone who has left the org has access to everything.
2. We cannot hide db passwords are config files of the websites have them in plain text (most of the CMS have config files storing passwords in plain text)

Temporary solution:
1. We have taken a Windows Cloud hosting and have configured all the servers to be accessed from the IP of that system only. So if users need to access the Linux serves they first need to login to that Windows server on cloud and then via Putty and Winscp, and MySQL Workbench access the server. The only advantage is that now even when the users know the SSH, MySQL ID and Password, they cannot login as their logins are deleted from the Windows account.

Somewhere inside I know that the person who gets to know the ways to allow other IPs for SSH and MySQL access on the server, can always configure it and may use it in future.

Request: Please do not start Windows bashing here. Since my team is more apt with the Windows environment, I have keep it that way.

share|improve this question
what's wrong with normal users and sudo? – mulaz Dec 3 '12 at 14:41

How about using any Directory Service? For instance LDAP seems to be fine. With additional authconfig (for OS layer), sudoers configuration you get rid of your 99% problems with user managment.

Also CI tools like Hudson/Jenkins, Bamboo etc can be easily configured with any LDAP.

For MySQL you can give another posixGroup with acces to mysql commands and also it solves problem with root password (just user belonging to groups).

I'm not sure if you can acces your code source repository with LDAP (If you got your own SVN/Git server its possible). I simply don't know that :)

share|improve this answer
+1. If you have (and intend to maintain) a Windows solution The Right Solution here is to have Active Directory serve as the central authentication and authorization store. In either case sudo and LDAP (using pam_ldap/nss_ldap, LDAP to store sudoers information, and the OpenSSH LPK patch to store SSH public key parts in LDAP) gets you 90% of the way to what you want. – voretaq7 Dec 3 '12 at 18:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.