<HTML><BODY><p style="font-family: Arial, Tahoma, Verdana, sans-serif; font-size: 13px; line-height: 18.2000007629395px;" data-mce-style="font-family: Arial, Tahoma, Verdana, sans-serif; font-size: 13px; line-height: 18.2000007629395px;">Alright then, thanks for info! Tomorrow is the deadline for my researches on FreeIPA. Then I have to start deploying a centralized management solution in our production environment. Please help me to make a final decision on which version of FreeIPA to choose - 3.3 or 4.1? I'd like to have all the benefits of the latest version, but all our production servers are FreeBSD. With all information sources at my disposal right now I tend to choose FreeIPA 3.3. The cause is that otherwise I can't use host groups with sudo commands - the cron script proposed at FreeBSD forums works with old way of storing host group information in the LDAP directory of FreeIPA. Is there any workaround for this?<span style="font-family: Arial, Tahoma, Verdana, sans-serif; font-size: 13px; line-height: 18.2000007629395px;" data-mce-style="font-family: Arial, Tahoma, Verdana, sans-serif; font-size: 13px; line-height: 18.2000007629395px;">(P.S. Here's what I'm talking about:<br style="font-family: Arial, Tahoma, Verdana, sans-serif; font-size: 13px; line-height: 18.2000007629395px;" data-mce-style="font-family: Arial, Tahoma, Verdana, sans-serif; font-size: 13px; line-height: 18.2000007629395px;"><blockquote style="font-family: Arial, Tahoma, Verdana, sans-serif;font-size: 13px;line-height: 18.2000007629395px;" cite="mid:5448D695.9020405@mail.ru" data-mce-style="font-family: Arial, Tahoma, Verdana, sans-serif; font-size: 13px; line-height: 18.2000007629395px;">"<span style="color: #141414;font-family: verdana, sans-serif;font-size: 15px;line-height: 20.5333347320557px;" data-mce-style="color: #141414; font-family: verdana, sans-serif; font-size: 15px; line-height: 20.5333347320557px;">The tricky part was getting <tt style="line-height: 14.6666679382324px;font-size: 15px;color: #007a00;" data-mce-style="line-height: 14.6666679382324px; font-size: 15px; color: #007a00;">sudo</tt><span style="color: #141414;font-family: verdana, sans-serif;font-size: 15px;line-height: 20.5333347320557px;" data-mce-style="color: #141414; font-family: verdana, sans-serif; font-size: 15px; line-height: 20.5333347320557px;"> to work with host groups. FreeIPA keeps host groups in netgroups, and FreeBSD's support for netgroups is limited. One solution would have been to enable NIS services on the FreeIPA server so that we could use proper netgroups on FreeBSD clients. We didn't like that solution, so instead we wrote a script that pulls all netgroup data from FreeIPA and stores it in <tt style="line-height: 14.6666679382324px;font-size: 15px;color: #007a00;" data-mce-style="line-height: 14.6666679382324px; font-size: 15px; color: #007a00;">/etc/netgroup</tt><span style="color: #141414;font-family: verdana, sans-serif;font-size: 15px;line-height: 20.5333347320557px;" data-mce-style="color: #141414; font-family: verdana, sans-serif; font-size: 15px; line-height: 20.5333347320557px;">. We run the script every hour via<tt style="line-height: 14.6666679382324px;font-size: 15px;color: #007a00;" data-mce-style="line-height: 14.6666679382324px; font-size: 15px; color: #007a00;"> cron</tt><span style="color: #141414;font-family: verdana, sans-serif;font-size: 15px;line-height: 20.5333347320557px;" data-mce-style="color: #141414; font-family: verdana, sans-serif; font-size: 15px; line-height: 20.5333347320557px;">." The script looks for host groups in 'cn=hostgroups,cn=accounts,dc=<domain>', and that works with FreeIPA 3.3. But in FreeIPA v4 host groups get in 'cn=ng,cn=compat,dc=<domain>'. So the script needs modification.</blockquote><span style="font-family: Arial, Tahoma, Verdana, sans-serif; font-size: 13px; line-height: 18.2000007629395px;" data-mce-style="font-family: Arial, Tahoma, Verdana, sans-serif; font-size: 13px; line-height: 18.2000007629395px;">But I don't know how to modify the script, simply changing the string passed to the ldapsearch command doesn't work.) Thu, 23 Oct 2014 16:41:55 +0300 от Alexander Bokovoy <abokovoy@redhat.com>: <blockquote style="border-left:1px solid #0857A6; margin:10px; padding:0 0 0 10px;"> <div id=""> <div class="js-helper js-readmsg-msg"> <style type="text/css"></style> <div> <base target="_self" href="https://e.mail.ru/"> <div id="style_14140717280000000890_BODY">On Thu, 23 Oct 2014, Orkhan Gasimov wrote: >And another interesting behaviour. > >Say a user "netuser" is a member of a user group "netstaff", >and a host "bsd.example.com" is a member of a host group "nethosts". >We then create an HBAC rule "netstaff_to_nethosts": > >Who: User Groups -> netstaff -- Accessing: Host Groups -> nethosts -- >Via Service: Specified Services and Groups -> sshd Here you are allowing only sshd service for use. > >And we create a SUDO rule "test": > >Who: Specified Users and Groups -> netuser -- Access this host: >bsd.example.com -- Run Commands: Any Command > >Expected result is this: user "netuser" should be able to SSH to host >"bsd.example.com" and successfully issue the command "sudo shutdown -r >now". > >What happens instead: user "netuser" is able to SSH to host >"bsd.example.com", but issuing the command "sudo shutdown -r now" >produces this output (password is entered correctly): > >$ shutdown -r now >Password: >Ying Tong Iddle I Po >Password: >Do you think like you type? >Password: >Have you considered trying to match wits with a rutabaga? > >This is funny, and you can continue trying sudo and getting funny >outputs; but the only way for the command to work properly is to >change the HBAC rule: > >Who: User Groups -> netstaff -- Accessing: Host Groups -> nethosts -- >Via Service: Specified Services and Groups -> ANY SERVICE > >Is this the correct behavior? I don't remember anything like this in >FreeIPA 3.3. Yes. The behaviour did not change since may be FreeIPA 2.0. sudo does authenticate and authorize user first via PAM stack and then applies own ruleset. So HBAC rules get applied here and since you don't have allow_all rule that would allow any user to access any service on any host, you get denial. Instead of using only sshd service in HBAC rule, make a service group and add both sshd and sudo there. Alternatively you can add multiple HBAC rules, one for sshd, one for sudo. -- / Alexander Bokovoy </div> <base target="_self" href="https://e.mail.ru/"> </div> </div> </div> </blockquote> </BODY></HTML>