<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: freeipa-users-bounces@redhat.com [mailto:freeipa-users-bounces@redhat.com] On Behalf Of Chris Card Sent: Friday, January 02, 2015 8:45 AM To: Brendan Kearney Cc: freeipa-users@redhat.com Subject: Re: [Freeipa-users] ipa / sudoers on centos 6.3 client<o:p></o:p> </div> </div> <o:p> </o:p> <div> <o:p> </o:p> <div> <div style="mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0in 0in 1.0pt 0in"> > Subject: Re: [Freeipa-users] ipa / sudoers on centos 6.3 client > From: <a href="mailto:bpk678@gmail.com">bpk678@gmail.com</a> > To: <a href="mailto:ctcard@hotmail.com">ctcard@hotmail.com</a> > CC: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> > Date: Fri, 2 Jan 2015 10:28:16 -0500 > > On Fri, 2015-01-02 at 15:19 +0000, Chris Card wrote: > > I have existing machines running CentOS 6.3 which I want to include in > > a freeipa domain. > > > > The domain controller machine is running Fedora 21 and > > freeipa-server-4.1.1-2 while the latest version of ipa I can find that > > runs on CentOS 6.3 is ipa-client-3.0.0-37.el6.x86_64. > > > > > > I have successfully run ipa-client-install on the CentOS 6.3 client > > and set up users who can ssh to the client using ssh-keys. > > > > > > The problem is that I can't get sudo rules to work. I know that the > > ipa client software version 3.0.0 doesn't automatically set up all the > > configuration for sssd to control sudo access, but I have set up all > > the configuration necessary manually: > > > > > > On the client, /etc/nsswitch.conf has > > > > > > sudoers files sss > > > > > > /etc/sssd/sssd/conf has > > > > > > [domain/default] > > > > > > cache_credentials = True > > krb5_realm = <REALM> > > krb5_server = <ipa server>:88 > > id_provider = ldap > > auth_provider = ldap > > chpass_provider = ldap > > ldap_tls_cacertdir = /etc/openldap/cacerts > > [domain/<domain>] > > > > > > cache_credentials = True > > krb5_store_password_if_offline = True > > ipa_domain = <domain> > > id_provider = ipa > > auth_provider = ipa > > access_provider = ipa > > chpass_provider = ipa > > ipa_dyndns_update = True > > ipa_server = <ipa server> > > ldap_tls_cacert = /etc/ipa/ca.crt > > sudo_provider = ldap > > ldap_uri = ldap://<ipa server> > > ldap_sudo_search_base = ou=sudoers,<domain base dn> > > ldap_sasl_mech = GSSAPI > > ldap_sasl_authid = host/<client fqdn> > > ldap_sasl_realm = <REALM> > > krb5_server = <ipa server> > > debug_level = 9 > > [sssd] > > services = nss, pam, ssh, sudo > > config_file_version = 2 > > > > > > domains = <domain>, default > > debug_level = 9 > > [nss] > > debug_level = 9 > > > > > > [pam] > > debug_level = 9 > > > > > > [sudo] > > debug_level = 9 > > [autofs] > > > > > > I have validated the ldap sasl configuration using ldapsearch, so I'm > > sure they are correct. > > > > > > The nisdomainname command returns the domain name. > > > > > > The sudo rules are: > > # ipa sudorule-find > > -------------------- > > 2 Sudo Rules matched > > -------------------- > > Rule name: sudo-host1 > > Enabled: TRUE > > Command category: all > > RunAs User category: all > > User Groups: host1-rw > > Host Groups: host1 > > Sudo Option: -authenticate > > > > > > Rule name: sudo-host2 > > Enabled: TRUE > > User Groups: host2-rw > > Host Groups: host2 > > Sudo Option: -authenticate > > ---------------------------- > > Number of entries returned 2 > > ---------------------------- > > > > > > When a user in user group host1-rw sshs to a client in host group > > host1 and runs "sudo su -" the user gets prompted for a password even > > though the sudo option -authenticate is set. > > I'm not convinced that sudo is even attempting to use sssd, but I'm > > not sure how to confirm this. > > > > > > I have seen some references to /etc/sudo-ldap.conf in online > > discussions of similar issues. This file exists on my client, but > > everything is commented out. Do I need to put the ldap client > > configuration in /etc/sudo-ldap.conf as well as /etc/sssd/sssd.conf > > for CentOS 6.3 clients? > > > > > > Any ideas about how to work out what is failing? > > > > > > Chris > > > try "!authenticate" (without the quotes), not "-authenticate" (again, > no quotes). That made no difference (though I think you're correct that -authenticate is wrong).<o:p></o:p> </div> </div> <div> Sudo didn’t work correctly for me until I updated to RHEL 6.6 which had sssd-1.11<o:p></o:p> Just saying…<o:p></o:p> Craig<o:p></o:p> </div> </div> </div> </body> </html>