<p>In our administration team everyone has root passwords for all client servers.
But what should we do if one of the team members is not longer working with us?
He still has our passwords and we have to change them all, every time someone leave us. </p>

<p>Now we are using ssh keys instead of passwords, but this is not helpful if we have to use something other than ssh.</p>

The systems I run have a
sudo
-only policy. i.e., the root password is
```
*
```
(disabled), and people have to use sudo to get root access. You can then edit your
```
sudoers
```
file to grant/revoke people's access. It's very granular, and has lots of configurability---but has sensible defaults, so it won't take you long to set up.