On Fri, Feb 19, 2016 at 09:30:20AM +1300, Richard Hector wrote: > That then means that you don't get to choose which people have root on > which boxes - anyone who gets the rule gets the lot. And that includes > anyone who leaves, of course.
Yes, but a leaked root password for one host does not translate into a leaked root password for other hosts, so there are some advantages. If the routine additionally concatenates a fixed password string, you can rotate that when staff leave and regenerate/reset all the passwords. > I think a better solution in the end is to generate a random password > for each box, and leave it, on paper, in a safe or similar. It's very > rare anyone needs to use it. In my past jobs we've always ended up doing something like that in the end, never getting an algorithmic solution like the above off the ground, but it does sound attractive to me. -- Jonathan Dowland Please do not CC me, I am subscribed to the list.