The more tricky bit here is in syncing the users (and passwords) to create a single sign-on (SSO) - for the /etc/apt/sources.list and /etc/profile you could use rsync as these files are unlikely to change too much.
Single Sign-On
However, for the SSO you'll need something like an LDAP server (Lightweight Directory Access Protocol). To install this run the following on your server machine (for the server I'd recommend Debian stable, so run the following on there):
sudo aptitude install slapd ldap-utils
It'll ask you to enter a password, remember it! Now slapd should ask you for a domain, but it didn't with me from memory, so run the following to set that up:
sudo dpkg-reconfigure slapd
At the first screen select no as you'll want to change the config. Then enter a domain name (this can be anything as it's on the local network, I'll use mylovelyserver.lan as the example domain here). Then enter an organisation name (again this can be anything, say My Lovely Server). Then enter a password for the admin. account, and re-enter it when prompted. Then select HDB as the database (not used BDB before, not entirely sure what the difference is!). Say no to purging the database when prompted. Select yes when prompted to move old database. Say no to allowing LDAPv2 (it's old and not needed for compatibility).
That should have an LDAP server running now, but it needs managing. Previously I've done this via the command line, but that to be honest was a ball-ache. So instead use phpldapadmin - it's a graphical web interface for managing LDAP servers. This requires a webserver, I'll use nginX here as it's lightweight and fine for the job. So run the following to install:
sudo aptitude install php5-fpm php5-cli php5-ldap php-apc phpldapadmin nginx
Next you'll need to edit /etc/phpldapadmin/config.php to change the settings to your own:
sudo nano /etc/phpldapadmin/config.php
Change this: $servers->setValue('server','base',array('dc=example,dc=com'));
To this: $servers->setValue('server','base',array('dc=mylovelyserver,dc=lan'))
And change this: $servers->setValue('login','bind_id','cn=admin,dc=example,dc=com');
To this: $servers->setValue('login','bind_id','cn=admin,dc=mylovelyserver,dc=lan');
Now you need to tell the webserver (nginX) where to server the phpldapadmin from. So open up the following:
sudo nano /etc/nginx/sites-available/default
Delete the main server block, and add in the following:
server {
root /usr/share/phpldapadmin/htdocs;
index index.php index.html;
server_name localhost;
location ~ \.php$ {
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
}
}
Then restart the webserver:
sudo service nginx restart
Now open up a browser and go to http://localhost or the IP address of the server. You should be on the phpLDAPadmin page, click login (on the left) and enter the admin. username and password set up above.
Click Create new entry here (on the left). Create a group first (Generic: POSIX Group). Type a name for the group (I'll use ldapgroup as the example). Click Create object, then commit.
Do the same for creating a new user, selecting the group you just made. Fill in the required fields.
That's the server-side stuff done! Now for the client-side (the other Debian, Ubuntu, and Raspberry Pi(s)).
On the clients install the following:
sudo aptitude install libpam-ldapd libnss-ldapd
On the first setup screen enter the localhost server address ldap://127.0.0.1
Then enter the LDAP server search base dc=mylovelyserver,dc=lan
When asked which name services to configure, just select everything there (using the space bar..).
The edit /etc/pam.d/common-session by running:
sudo nano /etc/pam.d/common-session
Adding the following at the end of the file:
session required pam_mkhomedir.so umask=0022 skel=/etc/skel
The client authentication should now be setup, running the following should show the user previously added at the end of the output of:
sudo getent passwd
Open up an SSH connection to the LDAP user and it should now work!
That's the username and password (SSO) bits done. Now you've not mentioned syncing /home directories, so I'll leave that bit for now, unless you need that too (it takes a bit more setting up).
Syncing Config Files
You have a few options here I think with /etc/apt/sources.list and /etc/profile. There's rsync (and SSH with rsync), cfengine (as you've said, probably overkill for this), and git (you could create a repo. then use that). However, although I don't like proprietary software, Dropbox could be the answer here (or OwnCLoud if you wanted to set that up, but again for a few config files, probably a little overkill).
Dropbox has a nice .deb for Debian / Ubuntu (and RPMs, etc. for Red Hat based systems), so get that form the Dropbox website (or use the Python script here: http://wiki.getdropbox.com/DropboxAddons/DropboxLinuxCLI if you don't want to use the GUI version).
Create a directory in your Dropbox directory once you've installed Dropbox:
mkdir -p ~/Dropbox/configs
Add in the config files you want to share in that directory.
Then create a symbolic link (symlink) on each client to the config files you want to share:
sudo ln -s ~/Dropbox/configs/sources.list /etc/apt/sources.list
sudo ln -s ~/Dropbox/configs/profile /etc/profile
And that should have your files synced! For further reading, etc. have a look at the Ubuntu LDAP and RSync, etc. documents and community wikis, I've found them a bit simpler than the Debian ones!
Also, for sharing /home directories, have a look at NFS (Network File System) and LDAP.
Just realised that was a long post..
post-receivehook would take care to "distribute" (e.g. checking out locally, and usingrsyncto xfer stuff to the other machines). Almost no overhead. Does that sound acceptable?~/configuration/debian-wheezy/etc/profileand a script that copies those files to all Debian Wheezy machines. But I read elsewhere that this might be good for a couple days and will end up in a nightmare to maintain since that does not scale. I might do something if the other options turn out to be overkill, but I would like to try a tool that was made for the job instead of tinkering around.