I work for Opscode so I'm a bit biased, but this is the sort of problem Chef was created to solve. I define all configuration in Chef stored in git repos( but any version control will work). This serves as both documentation and automation for consistency,
and has the added bonus of making infrastructure wide changes a snap. As an example imagine the case of an old compromised key or bad password from an ex-admin.
We manage our users through a sys-admins cookbook and our servers check in every 30 mins. This means I can change a key or disable a user and even if I forget to push to a particular server it will catch up within 30 minutes. Also because there's code
around how this is accomplished if I wanted to set passwords (I prefer not to set passwords and disable password logins entirely) I could enforce complexity around them in the cookbook.
I used creating users/keys as an example but that's only a small piece of the base role in my case. So every server runs the base role by default, which handles users, ntp, chef-client, iptables, ect. But all other configuration is also driven by Chef
and put into roles, so I can provision a new web server by simply applying the web role.
--
Paul Mooring
Systems Engineer and Customer Advocate
www.opscode.com