<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Went after the suggestion and sorry for the length of the sssd.conf, but I do want to ensure I’m not making the wrong option selection mistakes. The same error message is being produced. Additionally, this client and IDM server has no integration into AD at this point. Just trying to get IDM working on the legacy client.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Error and configuration provided below:<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">[mjsmith@chi-infra-idm-client2 ~]$ passwd<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Changing password for user mjsmith.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Enter login(LDAP) password:<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">New UNIX password:<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Retype new UNIX password:<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">LDAP password information update failed: Insufficient access<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Insufficient 'write' privilege to the 'userPassword' attribute of entry 'uid=mjsmith,cn=users,cn=compat,dc=linuxcccis,dc=com'.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">passwd: Permission denied<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"># grep -iv '#' ./sssd.conf <o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">[sssd]<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">config_file_version = 2<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">reconnection_retries = 3<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">sbus_timeout = 30<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">services = nss, pam<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; domains = LOCAL,LDAP<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">domains = LINUXCCCIS.COM<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">[nss]<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">;filter_groups = root<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">;filter_users = root<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">;reconnection_retries = 3<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; entry_cache_nowait_percentage = 300<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">[pam]<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">;reconnection_retries = 3<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; [domain/LOCAL]<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; description = LOCAL Users domain<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; id_provider = local<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; enumerate = true<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; min_id = 500<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; max_id = 999<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; [domain/LDAP]<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; id_provider = ldap<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; auth_provider = ldap<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_schema = rfc2307<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_uri = ldap://ldap.mydomain.org<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_search_base = dc=mydomain,dc=org<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_tls_reqcert = demand<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; cache_credentials = true<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; enumerate = False<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; entry_cache_timeout = 5400<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; [domain/AD]<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; description = LDAP domain with AD server<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; enumerate = false<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; min_id = 1000<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">;<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; id_provider = ldap<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; auth_provider = ldap<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_uri = ldap://your.ad.server.com<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_schema = rfc2307bis<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_default_bind_dn = cn=Administrator,cn=Users,dc=example,dc=com<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_default_authtok_type = password<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_default_authtok = YOUR_PASSWORD<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_user_object_class = person<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_user_name = msSFU30Name<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_user_uid_number = msSFU30UidNumber<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_user_gid_number = msSFU30GidNumber<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_user_home_directory = msSFU30HomeDirectory<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_user_shell = msSFU30LoginShell<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_user_principal = userPrincipalName<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_group_object_class = group<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_group_name = msSFU30Name<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_group_gid_number = msSFU30GidNumber<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">; ldap_force_upper_case_realm = True<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">[domain/LINUXCCCIS.COM]<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">;cache_credentials = True<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">;krb5_store_password_if_offline = True<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">ipa_domain = LINUXCCCIS.COM<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">id_provider = ldap<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">auth_provider = ldap<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">access_provider = ldap<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">chpass_provider = ldap<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">;ipa_dyndns_update = True<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">ipa_server = _srv_, chi-infra-idm-p1.linuxcccis.com<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">;ldap_tls_cacert = /var/tmp/ca.crt<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">ldap_tls_cacert = /etc/openldap/cacerts/authconfig_downloads.pem<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">;debug_level = 6<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> <p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Jeffrey Stormshak <br> <b>Sent:</b> Tuesday, November 24, 2015 7:46 AM<br> <b>To:</b> Jakub Hrozek; Rob Crittenden<br> <b>Cc:</b> freeipa-users@redhat.com<br> <b>Subject:</b> Re: [Freeipa-users] Oracle Linux 5.5 - Legacy Question<o:p></o:p></span></p> </div> </div> <p class="MsoNormal"><o:p> </o:p></p> <div> <div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">I went to review the ‘ip_provider’ and that looks like a ‘sssd.conf’ setting. The sssd RPM isn’t located on the 5.5 clients; nor is it in the YUM Channels for 5.5 base and 5.5 patch. So is the recommendation here to find any 5.X version of sssd RPM and use that for this configuration? Sorry, being a newbie on this product realistically isn’t helping here I’m sure …<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">The ipa-advise, is that part of the ipa-client RPM? That too, doesn’t exist on the 5.5 distribution as well. Even the version required to fix the openssl only worked with the 5.7 base version. Am I complete doomed for 5.5? Cards are stacked for sure. Nonetheless …<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">I feel so close though… Auth and Sudo works on 5.5 but something as simple as users changing passwords seems so simple to provide?<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p> </div> <div> <div> <p class="MsoNormal" style="background:white"><b><span style="font-size:10.0pt;font-family:"Palatino Linotype","serif";color:#1F497D">Jeffrey Stormshak, RHCSA | Sr. Linux Engineer</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p> <p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Palatino Linotype","serif";color:black">Platform Systems | IT Operations Infrastructure</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p> <p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Palatino Linotype","serif";color:black">CCC Information Services, Inc.</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p> <p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Palatino Linotype","serif";color:black">Phone: (312) 229-2552</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p> </div> </div> </div> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p> </div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> <p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">From: </span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Jakub Hrozek <<a href="mailto:jhrozek@redhat.com">jhrozek@redhat.com</a>><br> <b>Date: </b>Tuesday, November 24, 2015 at 2:25 AM<br> <b>To: </b>Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>><br> <b>Cc: </b>Jeffrey Stormshak <<a href="mailto:jstormshak@cccis.com">jstormshak@cccis.com</a>>, "<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>" <<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><br> <b>Subject: </b>Re: [Freeipa-users] Oracle Linux 5.5 - Legacy Question<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p> </div> <div> <div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">On Mon, Nov 23, 2015 at 09:32:52PM -0500, Rob Crittenden wrote:<o:p></o:p></span></p> </div> <blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-right:0in" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">Jeffrey Stormshak wrote:<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Jakub/Rob -<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Thanks for the feedback. I was finally able to ditch the ‘binddn’ and<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> was able to get SSL working upon upgrading the OpenSSL from the 5.5 base<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> to the one supplied in 5.7 base. The SSL is fully authenticating and<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> with sudo access. However, I’m riddled by the following item below.<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> I’m hoping that someone/somewhere encountered this issue and was able<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> to resolve it using this legacy 5.5. See details provided below. All<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> thoughts/suggestions are truly appreciated !!<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> *<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> *<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> $ id -a<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> uid=1403200001(pmoss) gid=7000(sysadmin) groups=7000(sysadmin)<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> $ passwd<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Changing password for user pmoss.<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Enter login(LDAP) password:<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> New UNIX password:<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Retype new UNIX password:<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> LDAP password information update failed: Insufficient access<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Insufficient 'write' privilege to the 'userPassword' attribute of entry<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> 'uid=pmoss,cn=users,cn=compat,dc=linuxcccis,dc=com'.<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> </span><span style="font-size:10.5pt;font-family:"MS Gothic";color:black"> </span><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> passwd: Permission denied<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> *<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> *<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> # ipa user-show pmoss --all --rights | grep -i userpass -> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> attributelevelrights: {u'userpassword': u'swo’, …<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> pmoss shows *u'userpassword': u'swo'* <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> ‘swo’ translates to ‘search,write,delete’<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Why wouldn’t the above be enough rights to be able to change ‘pmoss’<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> personal password? Thoughts ?<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">Because it is a different part of the tree.<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">Did you use ipa-advise to get the configuration? If so which profile?<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">It looks like that recommends using the compat tree. It's been forever<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">since I've manually configured a RHEL 5 system so I don't know if that<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">is correct or not.<o:p></o:p></span></p> </div> </blockquote> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">Using the compat tree for users and groups (which implies<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">id_provider=ldap, not ipa) is the right thing to do if you also want to<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">use AD trust users on an RHEL-5 client.<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">Otherwise, just use id_provider=ipa (but still point sudo to ou=sudoers)<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p> </div> <blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-right:0in" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">I'm pretty sure that nss_ldap supports RFC2307bis but it's really just a<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">distant memory.<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">rob<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> *Jeffrey Stormshak, RHCSA | Sr. Linux Engineer*<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Platform Systems | IT Operations Infrastructure<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> CCC Information Services, Inc.<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Phone: (312) 229-2552<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> From: Jakub Hrozek <<a href="mailto:jhrozek@redhat.com">jhrozek@redhat.com</a> <<a href="mailto:jhrozek@redhat.com%3e">mailto:jhrozek@redhat.com></a>><o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Date: Monday, November 23, 2015 at 1:58 AM<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> To: Jeffrey Stormshak <<a href="mailto:jstormshak@cccis.com">jstormshak@cccis.com</a> <<a href="mailto:jstormshak@cccis.com%3e">mailto:jstormshak@cccis.com></a>><o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Cc: Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a> <<a href="mailto:rcritten@redhat.com%3e">mailto:rcritten@redhat.com></a>>,<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> "<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> <<a href="mailto:freeipa-users@redhat.com%3e">mailto:freeipa-users@redhat.com></a>"<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> <<a href="mailto:freeipa-users@redhat.com%3e">mailto:freeipa-users@redhat.com></a>><o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Subject: Re: [Freeipa-users] Oracle Linux 5.5 - Legacy Question<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> On Sat, Nov 21, 2015 at 02:21:52AM +0000, Jeffrey Stormshak wrote:<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Rob -<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Here’s the test configurations/data when I manipulate the<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> BINDDN/BINDPW fields to get get both AUTH and SUDO to work in Linux<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> 5.5. I have three questions below that I would like to get your<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> comments on or see what you may recommend on this. I’m seriously<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> perplexed on this as to why its working this way … Please<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> advise. Thanks!<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> **************************************************************<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> AUTH successful on login; SUDO fails with the message listed<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> below !!<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> **************************************************************<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> [mjsmith@chi-infra-idm-client2 ~]$ sudo -l<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> sudo: ldap_sasl_bind_s(): Server is unwilling to perform<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Looks like the bind didn't finish successfully, can you look into<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> debugging sudo itself? The debugging changed a bit between releases, but<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> The sudo documentation would tell you..<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> [sudo] password for mjsmith:<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Sorry, user mjsmith may not run sudo on chi-infra-idm-client2.<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> *****************************************************<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> *****************************************************<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> # grep -iv ‘#’ /etc/ldap.conf<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> *****************************************************<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> base dc=linuxcccis,dc=com<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> uri ldap://chi-infra-idm-p1.linuxcccis.com/<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> binddn uid=admin,cn=users,cn=compat,dc=linuxcccis,dc=com<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> bindpw secret_pass<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> timelimit 15<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> bind_timelimit 5<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> idle_timelimit 3600<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> nss_initgroups_ignoreusers<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> pam_password md5<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> sudoers_base ou=SUDOers,dc=linuxcccis,dc=com<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> *************************************************<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> User Account AUTH and SUDO works when<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> commenting both the binddn and bindpw fields !!<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> *************************************************<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> vi /etc/ldap.conf … Comment these two fields …<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> #binddn uid=admin,cn=users,cn=compat,dc=linuxcccis,dc=com<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> #bindpw secret_pass<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> ************************************************<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> This file unchanged during the above testing !!<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> ************************************************<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> /etc/sudo-ldap.conf:<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> binddn uid=sudo,cn=sysaccounts,cn=etc,dc=linuxcccis,dc=com<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> bindpw secret_pass<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> ssl start_tls<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> tls_cacertfile /etc/ipa/ca.crt<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> tls_checkpeer yes<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> bind_timelimit 5<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> timelimit 15<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> uri ldap://chi-infra-idm-p1.linuxcccis.com<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> sudoers_base ou=SUDOers,dc=linuxcccis,dc=com<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> QUESTIONS:<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> 1) What BINDN account needs to be specified to allow the<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> BINDDN/BINDPW to work for SUDO?<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> 2) Why does the AUTH work when setting values in the BINDDN/BINDPW,<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> but SUDO then fails?<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> 3) If I leave BINDDN/BINDPW blank, what security risks are being<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> introduced by leaving it that way?<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> Anyone on the network can read sudo rules. I guess in theory, the<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> attacker might target accounts who are allowed to run sudo rules as a<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> gateway for getting elevated privileges on the machine..<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black">> <o:p></o:p></span></p> </div> </blockquote> <div> <p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p> </div> </div> </div> </div> </body> </html>