<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style></style></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1>Hi Folks:<o:p></o:p><o:p> </o:p>I am trying to configure sudo clients using FreeIPA 2.1.3 on CentOS 6.2 but it I am running into a problem that I do not know how to debug. I used the instructions provided here: <a href="http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/example-configuring-sudo.html">http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/example-configuring-sudo.html</a>. <o:p></o:p><o:p> </o:p>The server installation went fine and I even did a sudo client installation on the server which worked well. Unfortunately, when I did the same client setup on another host in the network I got the message: <user> not in sudoers files when I tried to execute a command.<o:p></o:p><o:p> </o:p>Here is the output from /var/log/secure on the client. I didn’t see anything strange on the server. The user name is bigbob.<o:p></o:p><o:p> </o:p>Jun 6 10:38:35 docs unix_chkpwd[8737]: password check failed for user (bigbob)<o:p></o:p>Jun 6 10:38:35 docs sudo: pam_unix(sudo:auth): authentication failure; logname=bigbob uid=0 euid=0 tty=/dev/pts/2 ruser=bigbob rhost= user=bigbob<o:p></o:p>Jun 6 10:38:36 docs sudo: pam_sss(sudo:auth): authentication success; logname=bigbob uid=0 euid=0 tty=/dev/pts/2 ruser=bigbob rhost= user=bigbob<o:p></o:p>Jun 6 10:38:36 docs sudo: bigbob : user NOT in sudoers ; TTY=pts/2 ; PWD=/home/bigbob ; USER=root ; COMMAND=/bin/ls<o:p></o:p>Jun 6 10:44:09 docs unix_chkpwd[8767]: password check failed for user (bigbob)<o:p></o:p>Jun 6 10:44:09 docs sudo: pam_unix(sudo:auth): authentication failure; logname=bigbob uid=0 euid=0 tty=/dev/pts/2 ruser=bigbob rhost= user=bigbob<o:p></o:p>Jun 6 10:44:10 docs sudo: pam_sss(sudo:auth): authentication success; logname=bigbob uid=0 euid=0 tty=/dev/pts/2 ruser=bigbob rhost= user=bigbob<o:p></o:p>Jun 6 10:44:10 docs sudo: bigbob : user NOT in sudoers ; TTY=pts/2 ; PWD=/home/bigbob ; USER=root ; COMMAND=/bin/pwd<o:p></o:p><o:p> </o:p>The command “/bin/pwd” is in the sudo commands and in the sudo command group.<o:p></o:p><o:p> </o:p>Any help would be greatly appreciated.<o:p></o:p><o:p> </o:p>Here are the setup steps that I performed on the client. The domain is foo.example.com.<o:p></o:p><o:p> </o:p># CITATION: <a href="http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/example-configuring-sudo.html">http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/example-configuring-sudo.html</a> <o:p></o:p><o:p> </o:p># ================================================================<o:p></o:p># Update /etc/nsswitch.conf<o:p></o:p># ================================================================<o:p></o:p>cat >/etc/nsswitch.conf <<EOF<o:p></o:p> <o:p></o:p># ================================================================<o:p></o:p># FreeIPA sudo support<o:p></o:p># ================================================================<o:p></o:p>sudoers: files ldap<o:p></o:p>sudoers_debug: 1<o:p></o:p>EOF<o:p></o:p> <o:p></o:p># ================================================================<o:p></o:p># Insert this just after the ipa_server line and restart sssd:<o:p></o:p># ldap_netgroup_search_base = cn=ng,cn=compat,dc=foo,dc=example,dc=com<o:p></o:p># ================================================================<o:p></o:p>cat /etc/sssd/sssd.conf | \<o:p></o:p>awk '{print $0;if($1=="ipa_server"){printf("ldap_netgroup_search_base = cn=ng,cn=compat,dc=foo,dc=example,dc=com\n");}}' >/tmp/x<o:p></o:p>cp /tmp/x /etc/sssd/sssd.conf<o:p></o:p>rm -f /tmp/x<o:p></o:p>service sssd restart<o:p></o:p> <o:p></o:p># ================================================================<o:p></o:p># Create the /etc/nslcd.conf file<o:p></o:p># ================================================================<o:p></o:p>ls /etc/nslcd.conf<o:p></o:p>cat >/etc/nslcd.conf <<EOF<o:p></o:p>binddn uid=sudo,cn=sysaccounts,cn=etc,dc=foo,dc=example,dc=com<o:p></o:p>bindpw pwd/sudo<o:p></o:p> <o:p></o:p>ssl start_tls<o:p></o:p>tls_cacertfile /etc/ipa/ca.crt<o:p></o:p>tls_checkpeer yes<o:p></o:p> <o:p></o:p>bind_timelimit 5<o:p></o:p>timelimit 15<o:p></o:p> <o:p></o:p>uri ldap://cuthbert.foo.example.com<o:p></o:p>sudoers_base ou=SUDOers,dc=foo,dc=example,dc=com<o:p></o:p>EOF<o:p></o:p> <o:p></o:p># ================================================================<o:p></o:p># Set the NIS domain name (even though NIS is not used)<o:p></o:p># ================================================================<o:p></o:p>nisdomainname foo.example.com<o:p></o:p><o:p> </o:p>Thank you,<o:p></o:p><o:p> </o:p>Joe<o:p></o:p><o:p> </o:p><o:p> </o:p></div></body></html>