well, at first glance pull seems much safer: All the machines can log in as special (non-root) user at _one_ server and fetch commands to run. If the master se

well, at first glance pull seems much safer: All the machines can log in as special (non-root) user at _one_ server and fetch commands to run. If the master server is compromised, all the other servers might* be as well, but at least you're not spreading root@ ssh keys around. * Maybe it's possible to predefine functions on the client and only ever run those. In practice that probably won't work because those functions will be either not powerful enough, or easy to misuse.