Say your enterprise has 1,000 Linux servers, all using directory services for authentication, as we have discussed so far. Now, suppose an errant user, wishing to bypass this privilege management, manages to create a local account called john on a single server. This might happen when privileges are temporarily granted for a change request but then revoked—unscrupulous individuals can easily create their own access methods, to bypass the security provided by your directory service.
How would you find this had happened? Although Ansible is not technically a tool for auditing, it has the benefit of being able to run a command (or set of commands) on 1,000 servers at once and returning the results to you for ...
