4

We have 15 Debian servers and growing.

What's a simple, lightweight method for centralizing user management? Use cases would be adding a user across all servers, tweaking a users access on a specific server(s), removing a user from all servers.

LDAP is an option but seems too full on for my needs. I'd rather something with the simplicity of useradd/groupadd, just spread across multiple machines. Web interface would be nice but not necessary. Git interface could be really cool.

Improve this question

4 Answers 4

Reset to default
5

There's several options, but it largely depends on your goals. LDAP is a lot more "light-weight" than you think. It's name is "Lightweight Directory Access Protocol" after all. A lot of it's "bulk" comes in when you add extra stuff to it. Of course, you can use almost anything to centralize authentication when it comes to *nix flavored OSes with PAM. Even a flat-text file if you so choose. Kerberos is another option... Radius... Samba/Active Directory... the list goes on. The biggest question is... how much do you want it to do... and what do you want from it?

Improve this answer
4
  • Well I use useradd/groupadd/visudo now which suits me just fine for a single server. If there was an option to make those changes apply to a bunch of servers that would work for me. I do drop peoples ssh pubkeys into their home dirs manually which is kind of tedious. If it optimized that away, that would be great. I'd actually be really happy with something Git-based. Like the way you manage gitolite/gitosis users. i.e. I put their pubkeys in a git repo, and a text file defining their access level to each server/group and when I push it up a bunch of git hooks make it all live.
    – lesysadmin
    Dec 20, 2011 at 19:17
  • 1
    If your servers are managed through "puppet" you can easily deploy changes to the PAM configs to every server... or simply deploy the ssh keys however you see fit. Like I said. The majority of this depends on YOUR needs...
    – TheCompWiz
    Dec 20, 2011 at 19:19
  • 1
    I'm reconsidering LDAP given what you said. But my main concern isn't that the protocol is heavy or the software setup is heavy, but my understanding is it's a service that is queried upon login to any server, thus I need to set up two servers for HA LDAP (this is the heavy part) or else I have a serious SPoF and I lose access to all my servers if the LDAP box dies. Is this correct? If so I think I prefer the fan-out approach using Puppet or whatever. For my case.
    – lesysadmin
    Dec 20, 2011 at 19:25
  • 2
    There's always issues when it comes to coming up with some sort of replicated management system. OpenLDAP has built-in replication mechanisms that may be of use to you. And depending on your PAM config, you can still have "local" admins and "network" admins separate from each other in-case your server cannot contact one of the LDAP servers.
    – TheCompWiz
    Dec 20, 2011 at 19:28
1

Take a look at PAM-MySQL or libnss-mysql. If you feel like being forgiving to LDAP, give nss_ldap a look over.

Improve this answer
1
  • Thanks for the tip Tim I don't have the power to upvote you just yet but in the meantime: +1
    – lesysadmin
    Dec 20, 2011 at 19:32
1

What's a simple, lightweight method for centralizing user management?

One light-weight method is to simply provision accounts with your configuration management system. For example Puppet is pretty easy to work with, and you can easily use it to create accounts. This probably wouldn't work well if you have a large number of non-technical users.

Right now, I only have 4 accounts I need to get setup on ~50 servers, setting up ldap/nis would be a big pain, particularly since some of the systems are located at remote customer locations.

Since your number of servers is growing, you should almost certainly be seriously looking at a configuration management system if you don't have one already.

Improve this answer
0

Based on this ...

use cases would be adding a user across all servers

You may want to check out distributed SSH.

This is useful if you need to make user changes infrequently but is pretty easy to setup and can be used for other admin purposes.

For example, if you have a host list of 15 servers, you could use dssh to add a user on all hosts or remove a user on all hosts.

I have used this successfully on up to 100 hosts at a time.

There are many options for this now, so if you take this route look around for a tool that will best meet your needs.

http://bashcurescancer.com/dssh-executing-an-arbitrary-command-in-parallel-on-an-arbitrary-number-of-hosts.html

This is just another option. LDAP is true centralized user management since all of your authentication assets are in one place. DSSH however is simple if you are fine with each box being independent.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .