<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
On Sun, 2013-09-08 at 23:11 +0200, Jakub Hrozek wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
On Sun, Sep 08, 2013 at 03:42:16PM -0500, Dean Hunter wrote:
<FONT COLOR="#737373">> On Sat, 2013-09-07 at 19:35 -0400, Dmitri Pal wrote:</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> > On 09/07/2013 02:11 PM, Christian Horn wrote:</FONT>
<FONT COLOR="#737373">> > > On Sat, Sep 07, 2013 at 12:06:37PM -0500, Dean Hunter wrote:</FONT>
<FONT COLOR="#737373">> > >> Are [1] and[2] still the current and best sources of information for</FONT>
<FONT COLOR="#737373">> > >> configuring sudo for use with the current release of FreeIPA on Fedora</FONT>
<FONT COLOR="#737373">> > >> 19?</FONT>
<FONT COLOR="#737373">> > >></FONT>
<FONT COLOR="#737373">> > >> 1.</FONT>
<FONT COLOR="#737373">> > >> <A HREF="http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/sudo.html">http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/sudo.html</A></FONT>
<FONT COLOR="#737373">> > >> 2.</FONT>
<FONT COLOR="#737373">> > >> <A HREF="http://www.freeipa.org/images/7/77/Freeipa30_SSSD_SUDO_Integration.pdf">http://www.freeipa.org/images/7/77/Freeipa30_SSSD_SUDO_Integration.pdf</A></FONT>
<FONT COLOR="#737373">> > > There is also the Identity_Management_Guide as part of the RHEL</FONT>
<FONT COLOR="#737373">> > > product documentation:</FONT>
<FONT COLOR="#737373">> > > <A HREF="https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/Identity_Management_Guide/index.html">https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/Identity_Management_Guide/index.html</A></FONT>
<FONT COLOR="#737373">> > This and the pdf above are the latest word in this area.</FONT>
<FONT COLOR="#737373">> > </FONT>
<FONT COLOR="#737373">> > > Christian</FONT>
<FONT COLOR="#737373">> > ></FONT>
<FONT COLOR="#737373">> > > _______________________________________________</FONT>
<FONT COLOR="#737373">> > > Freeipa-users mailing list</FONT>
<FONT COLOR="#737373">> > > <A HREF="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</A></FONT>
<FONT COLOR="#737373">> > > <A HREF="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</A></FONT>
<FONT COLOR="#737373">> > </FONT>
<FONT COLOR="#737373">> > </FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> Some sudo rules are causing:</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> [dean@desktop2 ~]$ sudo id</FONT>
<FONT COLOR="#737373">> sudo: internal error, tried to erealloc3(0)</FONT>
This is a known bug:
<A HREF="https://bugzilla.redhat.com/show_bug.cgi?id=1000389">https://bugzilla.redhat.com/show_bug.cgi?id=1000389</A>
I think the sudo rules are just missing the sudoHost attribute.
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> , but others do not. In the trial and error process of determining</FONT>
<FONT COLOR="#737373">> which rule specifications are causing the error, I have been restarting</FONT>
<FONT COLOR="#737373">> the virtual machine I am using as the sudo client between tests. Is</FONT>
<FONT COLOR="#737373">> there a better way to clear the SSSD cache between trials to make sure I</FONT>
<FONT COLOR="#737373">> am testing the most recent rule change?</FONT>
Unfortunately right now the only way is to rm the sssd cache which would
also remove any cached credentials. I thought there was an RFE open to
track the enhancement to make sss_cache invalidate and refresh sudo
rules, but I can't find it now in the SSSD trac, so I filed another one:
<A HREF="https://fedorahosted.org/sssd/ticket/2081">https://fedorahosted.org/sssd/ticket/2081</A>
Worst case, we mark it as a duplicate.
_______________________________________________
Freeipa-users mailing list
<A HREF="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</A>
<A HREF="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</A>
</PRE>
</BLOCKQUOTE>
<BR>
I saw bug report 1000389, but I could not understand it or whether it applied to me. <BR>
<BR>
I discovered that sudo rules for which I specified a host group caused the error. Rules with a host category of "all" instead of the host group did not cause the error. Is this what 1000389 says?<BR>
<BR>
<TT><FONT SIZE="2"> ipa sudorule-add server-admins --desc "Server Administrators"</FONT></TT><BR>
<TT><FONT SIZE="2"> ipa sudorule-mod server-admins --cmdcat all</FONT></TT><BR>
<TT><FONT SIZE="2"># ipa sudorule-add-host server-admins --hostgroups servers</FONT></TT><BR>
<TT><FONT SIZE="2"> ipa sudorule-mod server-admins --hostcat all</FONT></TT><BR>
<TT><FONT SIZE="2"> ipa sudorule-add-option server-admins --sudooption '!authenticate'</FONT></TT><BR>
<TT><FONT SIZE="2"> ipa sudorule-add-runasuser server-admins --users root</FONT></TT><BR>
<TT><FONT SIZE="2"> ipa sudorule-add-runasgroup server-admins --groups root</FONT></TT><BR>
<TT><FONT SIZE="2"> ipa sudorule-add-user server-admins --groups server-admins</FONT></TT><BR>
<BR>
This problem exists with the latest updates on both Fedora 18 and Fedora 19.<BR>
<BR>
I also discovered that libsss_sudo.so is missing from Fedora 18 installations.<BR>
<BR>
</BODY>
</HTML>