Centralized sudo sudoers file?

The absolute last thing I would want to do, is create a separate sudoers file, like Dave suggests. If you have a lot of machines, and only subtle differences apply (as is often the case), you really do not want this. It will generate a lot of overhead.

What you really want to do, is create one sudoers file. In that sudoers file, you can then define Host_Aliases for groups of systems for which you want a certain policy to apply. You can also make User_Aliases and whatnot. Done right, this gives you a huge benefit by having one file to edit, so it is easy to see what applies where and you don't have to worry about different versions of the sudoers file being deployed on different machines by accident.

New versions of sudo even support the sudoers.d directory in /etc, which might be of help too, but I haven't tried that yet.


Step 1. Setup an ldap server and configure all your machines to authenticate users and groups via ldap

Step 2. Create a master sudoers group in ldap, say yourcompany-sudoers. Give that group permission to sudo (with password) in the /etc/sudoers file on each machine.

Step 3. Create a sudoers-machinename group in ldap, add that group to /etc/sudoers on the corresponding machine.

With those three steps you don't need to edit the /etc/sudoers file after the machine is installed and you get a number of other benefits as well

For extra effect

Step 4. Setup puppet, cfengine, chef or similar, and deploy a templated sudoers file to each machine automatically.