I'm looking for the best approach to implement RBAC for about 100 Ubuntu servers. Currently all users are created locally mostly via Chef and we have no user directory service. All users have access to sudo to root and I'd like to limit the permissions to least privilege. My current thoughts:
- Implement OpenLDAP
- Use AppArmor to implement RBAC
- Map AppArmor profiles to LDAP groups
Thoughts on this approach? I haven't been able to find much online on best practises to implement RBAC on Linux, any help is appreciated.