Cyberark works great for this, it even lets you avoid having to share passwords for things like ssh and rdp. There are several vendors in this space. The new h

Cyberark works great for this, it even lets you avoid having to share passwords for things like ssh and rdp. There are several vendors in this space. The new hire in your scenario would be added to the right group, that group's members would have access to the right PAM tool vault. when they leave the company, they get removed from that group, thus removing their access. Shared passwords can also be managed passwords that get auto-rotated every so often.