This is my first time configuring it, can someone give me advice on how you would config the architecture? For example, I'm stuck on the fail back issue. If my openldap box goes down, how do my users log in. I've heard of the following two options.
1 - create local user accounts ... ok but doesn't this defeat the purpose of having a centralize login? Now I have to create 5 users for 40+ servers.
2 - create user accounts only on openldap and allow root access on server itself if openldap fails.
I like option two but I would like to disable direct access for root. So what are some ways to get around this? I know there isn't a right way or a wrong way but what's best practice?
Giving users root access is a definite no! They could break the system or at least install a back door access to root while they have it...
Creating local accounts could be done easily by a script that gets a list of the users from LDAP while LDAP is working (or else have a cron job that dumps the account information into a file from LDAP for use by a script to create local accounts), the fun bit will be setting the users passwords if and when they need to use those local accounts!
Fall back could be a second or even clustered LDAP server or even dare I mention it a NIS server if you really must have a fallback system of a different type?
Option 2 is definitely the best. And do NOT disable root access on each box or you might cripple the box if openldap is gone. Just make sure the local root account has a good password. Every openldap box I've touched has left the root account alone, and with good reason.
I agree, do not totally remove root access, what you can do is prevent SSH'ing into the machine as root in the sshd_config file (in /etc/ssh or /usr/local/etc possibly) by setting:
PermitRootLogin=no
Then kill -1 the root sshd process to get it to see the configuration change.
For Solaris in /etc/default/login set the line:
CONSOLE=/dev/console
so that root access may only be gained at the console, not via telnet, rlogin, etc.
For RedHat the /etc/securetty file serves a similar purpose and just needs to exist to prevent root telnet, etc..