<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1" style="word-wrap: break-word;">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Hi,<br>
<br>
Im trying to fault find why a user can sudo su - on a server but not its twin. <br>
<br>
I have nisdoaminnamae ods.vuw.ac.nz in rc.local.....<br>
and sudo-ldap.conf and nsswitch.conf appear to be identical but the hostname match fails.<br>
<br>
So for the working server,<br>
========<br>
sudo: ldap sudoHost '+servers-saas-root' ... MATCH! <br>
sudo: ldap sudoCommand '/bin/su -' ... MATCH! <br>
sudo: ldap sudoCommand '/bin/su - banner' ... MATCH! <br>
sudo: Command allowed sudo: user_matches=1 sudo: host_matches=1<br>
========<br>
<br>
For the failing server,<br>
========<br>
sudo: ldap sudoHost '+servers-saas-root' ... not <br>
sudo: ldap search 'sudoUser=+*' <br>
sudo: user_matches=1 <br>
sudo: host_matches=0<br>
========<br>
<br>
I have a host failure, yet the server is in that host group...the HBAC rule allows ssh and sudo....ssh works for both, so HBAC rule should be OK.<br>
<br>
The sudo command uses the same user and host groups as the HBAC...<br>
<br>
Damned if I can see a setup error.<br>
<br>
Ideas where to go looking next please?<br>
<div><br>
<div style="font-family: Tahoma; font-size: 13px;">
<p>regards</p>
<p>Steven Jones</p>
<p>Technical Specialist - Linux RHCE</p>
<p>Victoria University, Wellington, NZ</p>
<p>0064 4 463 6272</p>
</div>
</div>
<br>
</div>
</body>
</html>