everyone should have an ssh key that can be added to certain groups. Or a login to a VPN, or otherwise. Have some devops people responsible for managing access, i.e. adding people to appropriate groups when needed, and removing them when they leave (or are let go).<p>rely as little as possible on &#x27;passwords&#x27;. instead, use google apps and google oauth logins, that have an &#x27;admin&#x27; interface where you can turn them off if need be...