Sorry, for some reason gmail makes me forget about "reply all."
<div><br></div><div><div class="im" style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">On Wed, Jun 5, 2013 at 2:45 PM, Dmitri Pal <span dir="ltr"><<a href="mailto:dpal@redhat.com" target="_blank" style="color:rgb(17,85,204)">dpal@redhat.com</a>></span> wrote:</div>
<div class="gmail_quote" style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><div class="im" style="color:rgb(80,0,80)"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div>On 06/05/2013 11:20 AM, KodaK wrote:<blockquote type="cite">I know this has been discussed before, but I didn't see anything with a cursory search.<div><br></div><div>There are bugs when using user and host groups with sudo rules. I have to split out my users and hosts into individual entries. I'm running ipa 3.0.0-26 on RHEL.</div>
<div><br></div><div>All I really want to know is if this is fixed upstream.</div><div><br></div></blockquote><br></div>I am not sure I recall a bug you are referring to. A quick scan against the open tickets does not reveal anything like what you describe.<br>
Can you provide the description of the issue or point to the earlier thread on the matter? <br><br></div></blockquote><div> </div></div>I'm going off of memory on seeing the previous bug. It very well could be a false memory.<div>
<br></div><div>I have a rule like this:</div><div><br></div><div><div><div>[jebalicki@mo0033802 ~]$ ipa sudorule-show esolutions-sandbox-root-access</div><div> Rule name: esolutions-sandbox-root-access</div><div> Enabled: TRUE</div>
<div> Users: slfries, awellard</div><div> Hosts: <a href="http://slnessbxl01.unix.magellanhealth.com/" target="_blank" style="color:rgb(17,85,204)">slnessbxl01.unix.magellanhealth.com</a></div><div> Sudo Allow Commands: /bin/su -</div>
</div><div><br></div><div>This works. However, if I change the rule to use hostgroups instead of listing the hosts individually the rule will not work.</div><div><br></div><div>The groups still exist and look like this:</div>
<div><br></div><div><div>[jebalicki@mo0033802 ~]$ ipa hostgroup-show esolutions-sandbox-hosts</div><div> Host-group: esolutions-sandbox-hosts</div><div> Description: esolutions sandbox hosts</div><div> Member hosts: <a href="http://slnessbxl01.unix.magellanhealth.com/" target="_blank" style="color:rgb(17,85,204)">slnessbxl01.unix.magellanhealth.com</a></div>
<div> Member of HBAC rule: esolutions-sandbox-access</div></div><div><br></div><div><div>[jebalicki@mo0033802 ~]$ ipa group-show esolutions</div><div> Group name: esolutions</div><div> Description: esolutions group</div>
<div> GID: 1115600250</div><div> Member users: awellard, slfries</div><div> Member of HBAC rule: esolutions-sandbox-access</div></div><div><br></div><div>Client machine is pretty much default-out-of-the-box IRT IPA configuration, here's the installer output (installs during kickstart):</div>
<div><br></div><div><div>[root@slnessbxl01 ~]# cat ks-post.log</div><div>Discovery was successful!</div><div>Hostname: <a href="http://slnessbxl01.unix.magellanhealth.com/" target="_blank" style="color:rgb(17,85,204)">slnessbxl01.unix.magellanhealth.com</a></div>
<div>Realm: <a href="http://unix.magellanhealth.com/" target="_blank" style="color:rgb(17,85,204)">UNIX.MAGELLANHEALTH.COM</a></div><div>DNS Domain: <a href="http://unix.magellanhealth.com/" target="_blank" style="color:rgb(17,85,204)">UNIX.MAGELLANHEALTH.COM</a></div>
<div>IPA Server: <a href="http://slpidml01.unix.magellanhealth.com/" target="_blank" style="color:rgb(17,85,204)">slpidml01.unix.magellanhealth.com</a></div><div>BaseDN: dc=unix,dc=magellanhealth,dc=com</div><div><br></div>
<div><br></div><div>Synchronizing time with KDC...</div><div><br></div><div>Enrolled in IPA realm <a href="http://unix.magellanhealth.com/" target="_blank" style="color:rgb(17,85,204)">UNIX.MAGELLANHEALTH.COM</a></div><div>
Created /etc/ipa/default.conf</div><div>New SSSD config will be created.</div><div>Configured /etc/sssd/sssd.conf</div><div>Configured /etc/krb5.conf for IPA realm <a href="http://unix.magellanhealth.com/" target="_blank" style="color:rgb(17,85,204)">UNIX.MAGELLANHEALTH.COM</a></div>
<div>Warning: Hostname (<a href="http://slnessbxl01.unix.magellanhealth.com/" target="_blank" style="color:rgb(17,85,204)">slnessbxl01.unix.magellanhealth.com</a>) not found in DNS</div><div>DNS server record set to: <a href="http://slnessbxl01.unix.magellanhealth.com/" target="_blank" style="color:rgb(17,85,204)">slnessbxl01.unix.magellanhealth.com</a> -> 10.200.12.104</div>
<div>SSSD enabled</div><div>NTP enabled</div><div>Client configuration complete.</div></div><div><br></div><div><div>[root@slnessbxl01 ~]# rpm -qa | grep ipa</div><div>python-iniparse-0.3.1-2.1.el6.noarch</div><div>libipa_hbac-python-1.8.0-32.el6.x86_64</div>
<div>libipa_hbac-1.8.0-32.el6.x86_64</div><div>ipa-client-2.2.0-16.el6.x86_64</div><div>ipa-python-2.2.0-16.el6.x86_64</div><div>[root@slnessbxl01 ~]# cat /etc/redhat-release </div><div>Red Hat Enterprise Linux Server release 6.3 (Santiago)</div>
<div>[root@slnessbxl01 ~]# </div></div></div></div></div>