<html><body>Hi All, I have a significant amount of time on this and hoping some of you might have an idea. I want to limit user bob from getting to a root prompt on this test box. It seems to work until bob is able to run a command he is allowed via sudo such as cat. Sudo -i is on the deny command list in IPA and root is local(not in IPA) with nsswitch pointing to files first then sss. So logged on as user bob, first thing attempted was sudo -i which produces wrong pw message even though it is the correct pw but it is denying so fine. Then I issue sudo cat /etc/sysconfig/iptables and it allows it after I enter bob's pw which is fine. However right after that I try sudo -i again and get root prompt which is not good. I am thinking since root is local and files first then once I sudo up root is avail. Any suggestions are welcome [me@mine ~]$ ssh bob@server bob@servers password: Last login: Time: from IP Internal systems must only be used for conducting company business or for purposes authorized by company management Use is subject to audit at any time by company management [bob@server ~]$ sudo -i [sudo] password for bob: Sorry, try again. [bob@server ~]$ sudo -i [sudo] password for bob: Sorry, try again. [sudo] password for bob: Sorry, try again. [sudo] password for bob: sudo: 2 incorrect password attempts [bob@server ~]$ sudo cat /etc/sysconfig/iptables [sudo] password for bob: # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter [bob@server ~]$ sudo -i server.example.local:/root# cat /etc/sysconfig/iptables # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter ipa sudorule-show bob Rule name: bob Description: test sudo rule for user bob Enabled: TRUE Host category: all Users: bob Sudo Allow Commands: /sbin/iptables, /sbin/service, /bin/view, /bin/bash, /bin/netstat, /usr/bin/sudo -u user -i, /bin/cat Sudo Deny Commands: /usr/bin/sudo -i, /usr/bin/sudo-i, /usr/bin/sudo -u root -i Is it just me or is white space ignored as well with sudo commands much like the sudo options? Sean Hogan Security Engineer Watson Security & Risk Assurance Watson Cloud Technology and Support email: schogan@us.ibm.com | Tel 919 486 1397 <img src="cid:1__=88BBF59CDFE464BE8f9e8a93df938690918c88B@" width="67" height="53" align="top"> <img src="cid:2__=88BBF59CDFE464BE8f9e8a93df938690918c88B@" width="60" height="51" align="top"> </body></html>