<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
And another interesting behaviour.<br>
<br>
Say a user "netuser" is a member of a user group "netstaff",<br>
and a host "bsd.example.com" is a member of a host group "nethosts".<br>
We then create an HBAC rule "netstaff_to_nethosts":<br>
<br>
Who: User Groups -> netstaff -- Accessing: Host Groups ->
nethosts -- Via Service: Specified Services and Groups -> sshd<br>
<br>
And we create a SUDO rule "test":<br>
<br>
Who: Specified Users and Groups -> netuser -- Access this host:
bsd.example.com -- Run Commands: Any Command<br>
<br>
Expected result is this: user "netuser" should be able to SSH to
host "bsd.example.com" and successfully issue the command "sudo
shutdown -r now".<br>
<br>
What happens instead: user "netuser" is able to SSH to host
"bsd.example.com", but issuing the command "sudo shutdown -r now"
produces this output (password is entered correctly):<br>
<br>
$ shutdown -r now<br>
Password:<br>
Ying Tong Iddle I Po<br>
Password:<br>
Do you think like you type?<br>
Password:<br>
Have you considered trying to match wits with a rutabaga?<br>
<br>
This is funny, and you can continue trying sudo and getting funny
outputs; but the only way for the command to work properly is to
change the HBAC rule:<br>
<br>
Who: User Groups -> netstaff -- Accessing: Host Groups ->
nethosts -- Via Service: Specified Services and Groups -> ANY
SERVICE<br>
<br>
Is this the correct behavior? I don't remember anything like this in
FreeIPA 3.3.<br>
<br>
<div class="moz-cite-prefix">23-Oct-14 15:21, Orkhan Gasimov пишет:<br>
</div>
<blockquote cite="mid:5448D695.9020405@mail.ru" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
Yet with FreeIPA v4 we've got another thing to keep in mind
regarding FreeBSD - FreeIPA integration: the cron script proposed
at FreeBSD forums won't work.<br>
Here's what was said in the post:<br>
<br>
"<span style="color: rgb(20, 20, 20); font-family: verdana,
sans-serif; font-size: 15px; font-style: normal; font-variant:
normal; font-weight: normal; letter-spacing: normal;
line-height: 20.5333347320557px; orphans: auto; text-align:
left; text-indent: 0px; text-transform: none; white-space:
normal; widows: auto; word-spacing: 0px;
-webkit-text-stroke-width: 0px; display: inline !important;
float: none; background-color: rgb(255, 255, 255);">The tricky
part was getting<span class="Apple-converted-space"> </span></span><tt
style="font-family: monospace; line-height: 14.6666679382324px;
font-size: 15px; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; orphans: auto;
text-align: left; text-indent: 0px; text-transform: none;
white-space: normal; widows: auto; word-spacing: 0px;
-webkit-text-stroke-width: 0px; color: rgb(0, 122, 0);
background-color: rgb(255, 255, 255);">sudo</tt><span
style="color: rgb(20, 20, 20); font-family: verdana, sans-serif;
font-size: 15px; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; line-height:
20.5333347320557px; orphans: auto; text-align: left;
text-indent: 0px; text-transform: none; white-space: normal;
widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;
display: inline !important; float: none; background-color:
rgb(255, 255, 255);"><span class="Apple-converted-space"> </span>to
work with host groups. FreeIPA keeps host groups in netgroups,
and FreeBSD's support for netgroups is limited. One solution
would have been to enable NIS services on the FreeIPA server so
that we could use proper netgroups on FreeBSD clients. We didn't
like that solution, so instead we wrote a script that pulls all
netgroup data from FreeIPA and stores it in<span
class="Apple-converted-space"> </span></span><tt
style="font-family: monospace; line-height: 14.6666679382324px;
font-size: 15px; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; orphans: auto;
text-align: left; text-indent: 0px; text-transform: none;
white-space: normal; widows: auto; word-spacing: 0px;
-webkit-text-stroke-width: 0px; color: rgb(0, 122, 0);
background-color: rgb(255, 255, 255);">/etc/netgroup</tt><span
style="color: rgb(20, 20, 20); font-family: verdana, sans-serif;
font-size: 15px; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; line-height:
20.5333347320557px; orphans: auto; text-align: left;
text-indent: 0px; text-transform: none; white-space: normal;
widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;
display: inline !important; float: none; background-color:
rgb(255, 255, 255);">. We run the script every hour via</span><tt
style="font-family: monospace; line-height: 14.6666679382324px;
font-size: 15px; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; orphans: auto;
text-align: left; text-indent: 0px; text-transform: none;
white-space: normal; widows: auto; word-spacing: 0px;
-webkit-text-stroke-width: 0px; color: rgb(0, 122, 0);
background-color: rgb(255, 255, 255);"> cron</tt><span
style="color: rgb(20, 20, 20); font-family: verdana, sans-serif;
font-size: 15px; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; line-height:
20.5333347320557px; orphans: auto; text-align: left;
text-indent: 0px; text-transform: none; white-space: normal;
widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;
display: inline !important; float: none; background-color:
rgb(255, 255, 255);">.</span>"<br>
<br>
The script looks for host groups in
'cn=hostgroups,cn=accounts,dc=<domain>', and that works with
FreeIPA 3.3. But in FreeIPA v4 host groups get in
'cn=ng,cn=compat,dc=<domain>'. So the script needs
modification.<br>
<br>
<div class="moz-cite-prefix">23-Oct-14 12:09, Orkhan Gasimov
пишет:<br>
</div>
<blockquote cite="mid:5448A9C7.9020506@mail.ru" type="cite">I
already deployed FreeIPA 4.1 on Fedora 21 server alpha-release.
<br>
Everything is good as far as FreeIPA server operation is
concerned. <br>
<br>
<br>
23-Oct-14 01:06, William Graboyes пишет: <br>
<blockquote type="cite">3) am I insane for wanting to introduce
FC21 into my environment? <br>
</blockquote>
<br>
</blockquote>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>