Hi gurus:
We have several production *nix boxes from vendors and the policy here has been to give them root access as and when they require ( upgrade, troubleshooting the application, etc). Sudo is implemented on the systems but vendors cannot upgrade the application cause it says that the root password is needed to do it . As a result, we give them an account on the box and the root password so that they can login remotely and su to root. When they are done with their work, I change the root password and disable their account temporarily ( until the next access ). Is this a valid policy? How are you guys controlling vendor access to production boxes. Is there a way that the vendors can do whatever they want to do without them needing the root password. The OS I am running are solaris 9 and RH 3. Your insights into this issue would be really helpful.

Thanks in advance,

RG