I'm looking for the best approach to implement RBAC for about 100 Ubuntu servers. Currently all users are created locally mostly via Chef and we have no user directory service. All users have access to sudo to root and I'd like to limit the permissions to least privilege. My current thoughts:

  • Implement OpenLDAP
  • Use AppArmor to implement RBAC
  • Map AppArmor profiles to LDAP groups

Thoughts on this approach? I haven't been able to find much online on best practises to implement RBAC on Linux, any help is appreciated.

  • you may get more response on this at askubuntu.com as it's more about the packages/processes for doing it than the security of it... – Rory McCune Aug 24 '17 at 18:30
  • Or Unix & Linux if you aren't asking about Ubuntu-specific bits. – a CVn Aug 24 '17 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.