<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Hi,<br>
<br>
Sounds to complex, dont nest, KISS, Keep It Simple and Stupid.<br>
<br>
<div>regards
<div style="font-family:Tahoma; font-size:13px">
<p>Steven Jones</p>
<p>Technical Specialist - Linux RHCE</p>
<p>Victoria University, Wellington, NZ</p>
<p>0064 4 463 6272<br>
</p>
</div>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF129609"><font color="#000000" face="Tahoma" size="2"><b>From:</b> freeipa-users-bounces@redhat.com [freeipa-users-bounces@redhat.com] on behalf of Sina Owolabi [shinacalypse@gmail.com]<br>
<b>Sent:</b> Wednesday, 12 June 2013 11:56 a.m.<br>
<b>To:</b> freeipa-users@redhat.com<br>
<b>Subject:</b> [Freeipa-users] Sudo Commands and groups confusion<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>Hi <br>
</div>
Please help me understand what I am doing wrong:<br>
<br>
</div>
<div>Im using two RHEL6.4 ipa servers in a multi-master configuration <br>
</div>
Instead of creating multiple sudocmdgroups and sudo rules, I tried to subset what I could see in the /etc/sudoers files and have nested command groups and rules, to be applied to certain users and hostgroups as needed.<br>
</div>
I have a hostgroup called allservers, which applies to all servers.<br>
</div>
<br>
The allservers hostgroup is a member of sudo rule admin-commands, which I created for specific users to be able to run admin commands on all servers. I have added as members, multiple sudogroups, each of which have a number of commands inside of them. Despite
this, I find that sudo does not allow me to run any command as the users added to the admin-command rule. Please help me see where my logic is broken, and what to do to fix. Thanks a lot in advance.<br>
</div>
My sudo-ldap.conf is correctly configured, and so is nsswitch.conf. <br>
<br>
Output is below:<br>
<br>
sudo service httpd status<br>
[sudo] password for tuser: <br>
tuser is not allowed to run sudo on waphost. This incident will be reported.<br>
<div><br>
ipa sudorule-find admin-commands<br>
-------------------<br>
1 Sudo Rule matched<br>
-------------------<br>
Rule name: admin-commands<br>
Enabled: TRUE<br>
Users: tuser<br>
Host Groups: allservers<br>
Sudo Allow Command Groups: locate, networking, rooting, services, software, storage<br>
Sudo Option: !authenticate<br>
----------------------------<br>
Number of entries returned 1<br>
----------------------------<br>
<br>
<br clear="all">
<div>
<div>
<div>
<div>
<div>
<div><br>
-- <br>
best regards,<br>
<br>
Sina Owolabi<br>
+2348034022578<br>
+2348176469061 </div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>