<div dir="rtl"><div dir="ltr">Have you <span style="color:rgb(0,0,0)">installed libsss_sudo?</span></div><div dir="ltr"><font color="#000000">Try to follow the instruction here: </font></div><div dir="ltr"><font color="#000000"><a href="https://www.redhat.com/archives/freeipa-users/2013-June/msg00064.html">https://www.redhat.com/archives/freeipa-users/2013-June/msg00064.html</a><br>
</font></div><div dir="ltr"><font color="#000000">and</font></div><div dir="ltr"><font color="#000000"><a href="http://www.freeipa.org/images/7/77/Freeipa30_SSSD_SUDO_Integration.pdf">http://www.freeipa.org/images/7/77/Freeipa30_SSSD_SUDO_Integration.pdf</a> </font></div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote"><div dir="ltr">2014-04-08 22:17 GMT+03:00 Mark Gardner <span dir="ltr"><<a href="mailto:maleko42@gmail.com" target="_blank">maleko42@gmail.com</a>></span>:</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I know I'm missing something simple. But I just can't get this ipa client to accept any sudo rules.<div>
<br></div><div><div>-sh-4.1$ sudo -l</div><div>[sudo] password for <a href="mailto:testadm@domain.com" target="_blank">testadm@domain.com</a>:<br>
</div><div>User <a href="mailto:testadm@domain.com" target="_blank">testadm@domain.com</a> is not allowed to run sudo on cypress.</div><div>-sh-4.1$ id</div><div>uid=11659(<a href="mailto:testadm@domain.com" target="_blank">testadm@domain.com</a>) gid=11659(<a href="mailto:testadm@domain.com" target="_blank">testadm@domain.com</a>) groups=11659(testadm@domain.</div>
<div>com),160400007(ad_klasadm) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023</div></div><div><br></div><div><div>-sh-4.1$ kinit admin</div><div>Password for <a href="mailto:admin@HOSTED.DOMAIN.COM" target="_blank">admin@HOSTED.DOMAIN.COM</a>:</div>
<div>-sh-4.1$ ipa sudorule-show operations</div><div> Rule name: operations<br></div><div> Description: KLAS / System Admins</div><div> Enabled: TRUE</div><div> Command category: all</div><div> Users: localadm</div>
<div>
User Groups: ad_operations, ad_operations_external, ad_klasadm,</div><div> ad_klasadm_external</div><div><br></div></div><div>/var/log/sssd/sssd_sudo.log</div><div><div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_cmd_parse_query_done] (0x0200): Requesting rules for [testadm] from [<a href="http://DOMAIN.COM" target="_blank">DOMAIN.COM</a>]</div>
<div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requestinginfo about [<a href="mailto:testadm@DOMAIN.COM" target="_blank">testadm@DOMAIN.COM</a>]</div><div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_user] (0x0400): Returning info for user [<a href="mailto:testadm@DOMAIN.COM" target="_blank">testadm@DOMAIN.COM</a>]</div>
<div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_rules] (0x0400): Retrieving rules for [<a href="mailto:testadm@DOMAIN.COM" target="_blank">testadm@DOMAIN.COM</a>] from [<a href="http://DOMAIN.COM" target="_blank">DOMAIN.COM</a>]</div>
<div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sysdb_search_group_by_gid] (0x0400): No such entry</div>
<div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=<a href="mailto:testadm@DOMAIN.COM" target="_blank">testadm@DOMAIN.COM</a>)(sudoUser=#11659)(sudoUser=%ad_klasadm)(sudoUser=+*))(&(dataExpireTimestamp<=1396984126)))]</div>
<div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sysdb_search_group_by_gid] (0x0400): No such entry</div><div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=<a href="mailto:testadm@DOMAIN.COM" target="_blank">testadm@DOMAIN.COM</a>)(sudoUser=#11659)(sudoUser=%ad_klasadm)(sudoUser=+*)))]</div>
<div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_sudorules_from_cache] (0x0400): Returning 1 rules for [<a href="mailto:testadm@DOMAIN.COM" target="_blank">testadm@DOMAIN.COM</a>]</div><div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [client_recv] (0x0200): Client disconnected!</div>
</div><div><br></div><div><br></div><div><div>[root@cypress etc]# cat nsswitch.conf</div><div>#</div><div># /etc/nsswitch.conf</div><div>#</div><div># An example Name Service Switch config file. This file should be</div>
<div>
# sorted with the most-used services at the beginning.</div>
<div>#</div><div># The entry '[NOTFOUND=return]' means that the search for an</div><div># entry should stop if the search in the previous entry turned</div><div># up nothing. Note that if the search failed due to some other reason</div>
<div># (like no NIS server responding) then the search continues with the</div><div># next entry.</div><div>#</div><div># Valid entries include:</div><div>#</div><div># nisplus Use NIS+ (NIS version 3)</div>
<div># nis Use NIS (NIS version 2), also called YP</div><div># dns Use DNS (Domain Name Service)</div><div># files Use the local files</div><div>
# db Use the local database (.db) files</div><div># compat Use NIS on compat mode</div><div># hesiod Use Hesiod for user lookups</div><div># [NOTFOUND=return] Stop searching if not found so far</div>
<div>#</div><div><br></div><div># To use db, put the "db" in front of "files" for entries you want to be</div><div># looked up first in the databases</div><div>#</div><div># Example:</div><div>#passwd: db files nisplus nis</div>
<div>#shadow: db files nisplus nis</div><div>#group: db files nisplus nis</div><div><br></div><div>passwd: files sss</div><div>shadow: files sss</div><div>group: files sss</div><div>sudoers: files sss</div>
<div><br></div><div>#hosts: db files nisplus nis dns</div><div>hosts: files dns</div><div><br></div><div># Example - obey only what nisplus tells us...</div><div>#services: nisplus [NOTFOUND=return] files</div>
<div>#networks: nisplus [NOTFOUND=return] files</div><div>#protocols: nisplus [NOTFOUND=return] files</div><div>#rpc: nisplus [NOTFOUND=return] files</div><div>#ethers: nisplus [NOTFOUND=return] files</div>
<div>
#netmasks: nisplus [NOTFOUND=return] files</div><div><br></div><div>bootparams: nisplus [NOTFOUND=return] files</div><div><br></div><div>ethers: files</div><div>netmasks: files</div><div>networks: files</div><div>
protocols: files</div><div>rpc: files</div><div>services: files sss</div><div><br></div><div>netgroup: files sss</div><div><br></div><div>publickey: nisplus</div><div><br></div><div>automount: files</div><div>
aliases: files nisplus</div><div><br></div><div>[root@cypress etc]# cd sssd</div><div>[root@cypress sssd]# ls</div><div>sssd.conf sssd.conf.deleted <a href="http://sssd.conf.sv" target="_blank">sssd.conf.sv</a></div>
<div>[root@cypress sssd]# cat sssd.conf</div>
<div>[domain/<a href="http://hosted.domain.com" target="_blank">hosted.domain.com</a>]</div><div><br></div><div>cache_credentials = True</div><div>krb5_store_password_if_offline = True</div><div>ipa_domain = <a href="http://hosted.domain.com" target="_blank">hosted.domain.com</a></div>
<div>id_provider = ipa</div><div>auth_provider = ipa</div><div>access_provider = ipa</div><div>ipa_hostname = <a href="http://cypress.hosted.domain.com" target="_blank">cypress.hosted.domain.com</a></div><div>chpass_provider = ipa</div>
<div>
ipa_dyndns_update = True</div><div>ipa_server = _srv_, <a href="http://ipa.hosted.domain.com" target="_blank">ipa.hosted.domain.com</a></div><div>ldap_tls_cacert = /etc/ipa/ca.crt</div><div>debug_level=6</div><div><br></div>
<div>#</div><div>
# sudo integration</div><div>#</div><div>sudo_provider = ldap</div><div>ldap_uri = ldap://<a href="http://ipa.hosted.domain.com" target="_blank">ipa.hosted.domain.com</a></div><div>ldap_sudo_search_base = ou=sudoers,dc=hosted,dc=domain,dc=com</div>
<div>ldap_sasl_mech = GSSAPI</div><div>ldap_sasl_authid = host/<a href="http://cypress.hosted.domain.com" target="_blank">cypress.hosted.domain.com</a></div><div>ldap_sasl_realm = <a href="http://HOSTED.DOMAIN.COM" target="_blank">HOSTED.DOMAIN.COM</a></div>
<div>krb5_server = <a href="http://ipa.hosted.domain.com" target="_blank">ipa.hosted.domain.com</a></div><div><br></div><div><br></div><div>[sssd]</div><div>services = nss, pam, ssh, pac, sudo</div><div>config_file_version = 2</div>
<div>
domains = <a href="http://hosted.domain.com" target="_blank">hosted.domain.com</a></div><div>debug_level=6</div><div><br></div><div>[nss]</div><div><br></div><div><br></div><div>[pam]</div><div><br></div><div><br></div><div>
[sudo]</div><div>
debug_level=6</div><div><br></div><div>[autofs]</div><div><br></div><div>[ssh]</div><div><br></div><div><br></div><div>[pac]</div><div><br></div><div>[root@cypress sssd]#</div></div><div><br></div></div>
<br>_______________________________________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br></blockquote></div><br></div>