On Thu, 25 Sep 2014, Joakim Tjernlund wrote:
Because as an admin I need to login on users boxes to fix stuff they
broke.
Sometimes su/sudo are not setup/broken too.
>
> If your goal is to have the same root password across an enterprise, I
> recommend something like Puppet or Ansible.
How does that help me to ssh in and what if Puppet/Ansible is not
setup/broken?
Not every box is installed the same.
If every machine is different, and you can't be sure su/sudo are working, and
you don't know the local root password, I'd not have a lot of faith that sssd
would be working. Add to that, you're talking about breaking best practice as
I'd prefer to see root password based logins disallowed.
If you want the lightest touch setup that gets you what you want, I'd just
stick a /root/.ssh/authorized_keys file on every machine's root account.
That'd work just fine with sssd, and unless ssh is broken, and the local admin
has deliberately deleted that file, you'll get in. You'll get into a much
more broken system with that than you would relying on sssd.
jh