automated change password on linux servers

Question

Dear friends and colleges

Each half year we need to change the password on our redhat Linux servers ,

we have 8723 servers!!! In our company

Is it possible to automate password changing each half year without our involving ?

Regarding the password name – how to know it , so it very simple only one server from all our server will get this password , lets say in /var/pass/pass.txt

Is it wonderful innovation ?

each half year I use expect script and run it on all our serves , but this take time — jango, Aug 17 '17 at 07:13
just publish your answer so I can select your answer as the best answer — jango, Aug 17 '17 at 08:20
Also you urgently need to look into config management tools. — Sven, Aug 17 '17 at 08:20
@Sven can you please let is know more about this - your opinion is very important to us — jango, Aug 17 '17 at 08:25
Look up Puppet, Ansible, Chef (others exists) to learn more about some popular config management tools. — Sven, Aug 17 '17 at 08:32

score 4 · Accepted Answer · answered Aug 17 '17 at 08:33

Honestly, with 8723 servers you should already have some automation and configuration management and if you don't: this is a perfect use-case to start introducing it. Resetting local (root) passwords is fairly trivial to automate with tools Puppet, chef, Ansible, Red Hat Satellite etc.

Alternatives:

Replace local (management) accounts with centralised authentication in the form of LDAP, FreeIPA, radius or even AD. That results in only a single place where to enforce password policies and/or reset passwords for your admins and users.
Configure sudo with access rights based on group membership and nobody needs to know or use the actual root password(s) anymore, negating the need both set a valid/known root password or to ever change that password.
In the rare cases that you would need actual root access you can boot in single user mode or from a rescue image (or follow the RHEL7 root password recovery procedure )
If you do need valid root paswords look in to privileged password management software which automates securely storing passwords and controlling access to them. Typically such a system will also periodically reset privileged account passwords and after an admin was granted access to a system such software will also reset the password again, to deny the admin future access

the most great answer that I seen never , thx a lot – jango Aug 17 '17 at 12:40 — jango, Aug 17 '17 at 12:40

automated change password on linux servers

1 Answers1