<div dir="ltr"><div><div><div><div><div>Hi Rob,<br></div>thanks, but this is not the case.<br></div>Firstly, for initial test purposes I am not limiting sudo to specific commands, in the rule it is set to "any".<br></div>Secondly, it fails even in non-symlink cases:<br><br>[root@zp-cml-test ~]# which service<br>/sbin/service<br>[root@zp-cml-test ~]# ll /sbin/service<br>-rwxr-xr-x. 1 root root 1694 Oct 16 2014 /sbin/service<br>[root@zp-cml-test ~]# logout<br>[simecek.tomas@sd-stc.cz@zp-cml-test ~]$ sudo service sshd restart<br>[sudo] password for <a href="mailto:simecek.tomas@sd-stc.cz">simecek.tomas@sd-stc.cz</a>: <br><a href="mailto:simecek.tomas@sd-stc.cz">simecek.tomas@sd-stc.cz</a> is not in the sudoers file. This incident will be reported.<br><br></div>Thanks anyway, let me know if something else comes to your mind.<br><br></div>Tomas<br></div><div class="gmail_extra"><br><div class="gmail_quote">2016-07-14 11:51 GMT+02:00 Rob Verduijn <span dir="ltr"><<a href="mailto:rob.verduijn@gmail.com" target="_blank">rob.verduijn@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div><div>hi,<br><br></div>just a long shot here..<br><br></div>I've been battling sudo for a couple days now and found that my issue was one related to symlinks<br></div>on centos7 'which cat' says /bin/cat<br></div>but on centos /bin is a symlink to /usr/bin and sudo knows a symlink when it sees one and to prevent abuse it requires the 'real' path for the sudo rule : <user> ALL=(ALL) /usr/bin/cat<br></div>on centos6 which cat also says /bin/cat but since /bin is not a symlink it requires the sudo rule to be <user> ALL=(ALL) /bin/cat<br></div><div>so for the sudo to work on both centos6 and centos7 you would require 2 sudo rules.<br></div><div><br></div><div>Ignore me if this is irrelevant.<br></div><div><br></div>Just my 2 cents<br></div>Rob<br></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">2016-07-14 10:38 GMT+02:00 Lukas Slebodnik <span dir="ltr"><<a href="mailto:lslebodn@redhat.com" target="_blank">lslebodn@redhat.com</a>></span>:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">On (14/07/16 10:09), Tomas Simecek wrote:<br>
>Thanks all of you guys,<br>
>I have updated to:<br>
>sssd-krb5-common-1.13.3-22.el6_8.4.x86_64<br>
>sssd-1.13.3-22.el6_8.4.x86_64<br>
>sssd-ldap-1.13.3-22.el6_8.4.x86_64<br>
>sssd-client-1.13.3-22.el6_8.4.x86_64<br>
>sssd-ad-1.13.3-22.el6_8.4.x86_64<br>
>sssd-proxy-1.13.3-22.el6_8.4.x86_64<br>
>libsss_idmap-1.13.3-22.el6_8.4.x86_64<br>
>sssd-common-1.13.3-22.el6_8.4.x86_64<br>
>sssd-ipa-1.13.3-22.el6_8.4.x86_64<br>
>python-sssdconfig-1.13.3-22.el6_8.4.noarch<br>
>sssd-krb5-1.13.3-22.el6_8.4.x86_64<br>
>sssd-common-pac-1.13.3-22.el6_8.4.x86_64<br>
>(there does not seem to be libsss_sudo in Centos as suggested by Danila).<br>
>and restarted sssd.<br>
><br>
>There are two rules enabled. One HBAC as I presented earlier:<br>
> Rule name: Unixari na test servery<br>
> Enabled: TRUE<br>
> User Groups: grpunixadmins<br>
> Hosts: <a href="http://spcss-2t-www.linuxdomain.cz" rel="noreferrer" target="_blank">spcss-2t-www.linuxdomain.cz</a>, <a href="http://zp-cml-test.linuxdomain.cz" rel="noreferrer" target="_blank">zp-cml-test.linuxdomain.cz</a><br>
> Services: login, sshd, sudo, sudo-i, su, su-l<br>
><br>
>and one sudo rule:<br>
>Rule name: Pokusne<br>
> Enabled: TRUE<br>
> Command category: all<br>
> User Groups: grpunixadmins<br>
> Hosts: <a href="http://spcss-2t-www.linuxdomain.cz" rel="noreferrer" target="_blank">spcss-2t-www.linuxdomain.cz</a>, <a href="http://zp-cml-test.linuxdomain.cz" rel="noreferrer" target="_blank">zp-cml-test.linuxdomain.cz</a><br>
><br>
>Default "all-access" rules are disabled.<br>
><br>
>When I try to sudo as AD user (member of grpunixadmins) on Centos 6.6, I<br>
>still get:<br>
><br>
>[simecek.tomas@sd-stc.cz@zp-cml-test ~]$ sudo cat /etc/nsswitch.conf<br>
>[sudo] password for <a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>:<br>
><a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a> is not in the sudoers file. This incident will be<br>
>reported.<br>
><br>
>It works fine on Centos 7 (<a href="http://spcss-2t-www.linuxdomain.cz" rel="noreferrer" target="_blank">spcss-2t-www.linuxdomain.cz</a>).<br>
><br>
>sssd.conf:<br>
>[domain/<a href="http://linuxdomain.cz" rel="noreferrer" target="_blank">linuxdomain.cz</a>]<br>
>cache_credentials = True<br>
>krb5_store_password_if_offline = True<br>
>ipa_domain = <a href="http://linuxdomain.cz" rel="noreferrer" target="_blank">linuxdomain.cz</a><br>
>id_provider = ipa<br>
>krb5_realm = <a href="http://LINUXDOMAIN.CZ" rel="noreferrer" target="_blank">LINUXDOMAIN.CZ</a><br>
>auth_provider = ipa<br>
>access_provider = ipa<br>
>ipa_hostname = <a href="http://zp-cml-test.linuxdomain.cz" rel="noreferrer" target="_blank">zp-cml-test.linuxdomain.cz</a><br>
>chpass_provider = ipa<br>
>ipa_server = <a href="http://svlxxipap.linuxdomain.cz" rel="noreferrer" target="_blank">svlxxipap.linuxdomain.cz</a><br>
>ldap_tls_cacert = /etc/ipa/ca.crt<br>
>override_shell = /bin/bash<br>
>sudo_provider = ipa<br>
>ldap_uri = ldap://<a href="http://svlxxipap.linuxdomain.cz" rel="noreferrer" target="_blank">svlxxipap.linuxdomain.cz</a><br>
>ldap_sudo_search_base = ou=sudoers,dc=linuxdomain,dc=cz<br>
>ldap_sasl_mech = GSSAPI<br>
>#ldap_sasl_authid = host/<a href="mailto:zp-cml-test.linuxdomain.cz@LINUXDOMAIN.CZ" target="_blank">zp-cml-test.linuxdomain.cz@LINUXDOMAIN.CZ</a><br>
>ldap_sasl_authid = host/<a href="http://zp-cml-test.linuxdomain.cz" rel="noreferrer" target="_blank">zp-cml-test.linuxdomain.cz</a><br>
>ldap_sasl_realm = <a href="http://LINUXDOMAIN.CZ" rel="noreferrer" target="_blank">LINUXDOMAIN.CZ</a><br>
>krb5_server = <a href="http://svlxxipap.linuxdomain.cz" rel="noreferrer" target="_blank">svlxxipap.linuxdomain.cz</a><br>
>debug_level = 0x3ff0<br>
>[sssd]<br>
>services = nss, sudo, pam, ssh<br>
>config_file_version = 2<br>
>domains = <a href="http://linuxdomain.cz" rel="noreferrer" target="_blank">linuxdomain.cz</a><br>
>[nss]<br>
>homedir_substring = /home<br>
>[pam]<br>
>[sudo]<br>
>debug_level = 0x3ff0<br>
>[autofs]<br>
>[ssh]<br>
>[pac]<br>
>[ifp]<br>
><br>
><br>
>sssd_sudo.log from the moment I tried sudo:<br>
>(Thu Jul 14 09:53:41 2016) [sssd[sudo]] [sysdb_search_group_by_gid]<br>
>(0x0400): No such entry<br>
>(Thu Jul 14 09:53:41 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache]<br>
>(0x0200): Searching sysdb with<br>
>[(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=<br>
><a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>)(sudoUser=#988604700)(sudoUser=%domain\<br>
><a href="mailto:20users@sd-stc.cz" target="_blank">20users@sd-stc.cz</a>)(sudoUser=%<a href="mailto:unixadmins@sd-stc.cz" target="_blank">unixadmins@sd-stc.cz</a><br>
>)(sudoUser=%grpunixadmins)(sudoUser=%<a href="mailto:mfcr_mfg@sd-stc.cz" target="_blank">mfcr_mfg@sd-stc.cz</a>)(sudoUser=%<br>
><a href="mailto:account@sd-stc.cz" target="_blank">account@sd-stc.cz</a>)(sudoUser=%<a href="mailto:wifiadmins@sd-stc.cz" target="_blank">wifiadmins@sd-stc.cz</a><br>
>)(sudoUser=+*))(&(dataExpireTimestamp<=1468482821)))]<br>
>(Thu Jul 14 09:53:41 2016) [sssd[sudo]] [sudosrv_get_rules] (0x2000): About<br>
>to get sudo rules from cache<br>
>(Thu Jul 14 09:53:41 2016) [sssd[sudo]] [sysdb_search_group_by_gid]<br>
>(0x0400): No such entry<br>
>(Thu Jul 14 09:53:41 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache]<br>
>(0x0200): Searching sysdb with<br>
>[(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a><br>
>)(sudoUser=#988604700)(sudoUser=%domain\<a href="mailto:20users@sd-stc.cz" target="_blank">20users@sd-stc.cz</a>)(sudoUser=%<br>
><a href="mailto:unixadmins@sd-stc.cz" target="_blank">unixadmins@sd-stc.cz</a>)(sudoUser=%grpunixadmins)(sudoUser=%<a href="mailto:mfcr_mfg@sd-stc.cz" target="_blank">mfcr_mfg@sd-stc.cz</a><br>
>)(sudoUser=%<a href="mailto:account@sd-stc.cz" target="_blank">account@sd-stc.cz</a>)(sudoUser=%<a href="mailto:wifiadmins@sd-stc.cz" target="_blank">wifiadmins@sd-stc.cz</a><br>
>)(sudoUser=+*)))]<br>
>(Thu Jul 14 09:53:41 2016) [sssd[sudo]] [sudosrv_get_sudorules_from_cache]<br>
>(0x0400): Returning 0 rules for [<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>]<br>
>(Thu Jul 14 09:53:47 2016) [sssd[sudo]] [client_recv] (0x0200): Client<br>
>disconnected!<br>
>(Thu Jul 14 09:53:47 2016) [sssd[sudo]] [client_destructor] (0x2000):<br>
>Terminated client [0x260b690][17]<br>
>(Thu Jul 14 09:53:51 2016) [sssd[sudo]] [sbus_message_handler] (0x2000):<br>
>Received SBUS method org.freedesktop.sssd.service.ping on path<br>
>/org/freedesktop/sssd/service<br>
>(Thu Jul 14 09:53:51 2016) [sssd[sudo]] [sbus_get_sender_id_send] (0x2000):<br>
>Not a sysbus message, quit<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [accept_fd_handler] (0x0400):<br>
>Client connected!<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sss_cmd_get_version] (0x0200):<br>
>Received client version [1].<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sss_cmd_get_version] (0x0200):<br>
>Offered version [1].<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_cmd] (0x2000): Using<br>
>protocol version [1]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sss_parse_name_for_domains]<br>
>(0x0200): name '<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>' matched expression for domain '<br>
><a href="http://sd-stc.cz" rel="noreferrer" target="_blank">sd-stc.cz</a>', user is simecek.tomas<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sss_parse_name_for_domains]<br>
>(0x0200): name '<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>' matched expression for domain '<br>
><a href="http://sd-stc.cz" rel="noreferrer" target="_blank">sd-stc.cz</a>', user is simecek.tomas<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_cmd_parse_query_done]<br>
>(0x0200): Requesting default options for [simecek.tomas] from [<a href="http://sd-stc.cz" rel="noreferrer" target="_blank">sd-stc.cz</a>]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sss_ncache_check_str] (0x2000):<br>
>Checking negative cache for [NCE/USER/<a href="http://sd-stc.cz/simecek.tomas" rel="noreferrer" target="_blank">sd-stc.cz/simecek.tomas</a>]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_user] (0x0200):<br>
>Requesting info about [<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_user] (0x0400):<br>
>Returning info for user [<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_rules] (0x0400):<br>
>Retrieving default options for [<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>] from [<a href="http://sd-stc.cz" rel="noreferrer" target="_blank">sd-stc.cz</a>]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sysdb_search_group_by_gid]<br>
>(0x0400): No such entry<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache]<br>
>(0x0200): Searching sysdb with<br>
>[(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=<br>
><a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>)(sudoUser=#988604700)(sudoUser=%domain\<br>
><a href="mailto:20users@sd-stc.cz" target="_blank">20users@sd-stc.cz</a>)(sudoUser=%<a href="mailto:unixadmins@sd-stc.cz" target="_blank">unixadmins@sd-stc.cz</a>)(sudoUser=%<br>
><a href="mailto:wifiadmins@sd-stc.cz" target="_blank">wifiadmins@sd-stc.cz</a>)(sudoUser=%grpunixadmins)(sudoUser=%<a href="mailto:mfcr_mfg@sd-stc.cz" target="_blank">mfcr_mfg@sd-stc.cz</a><br>
>)(sudoUser=+*))(&(dataExpireTimestamp<=1468482835)))]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_rules] (0x2000): About<br>
>to get sudo rules from cache<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache]<br>
>(0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(name=defaults)))]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_sudorules_from_cache]<br>
>(0x0400): Returning 0 rules for [<default options>@<a href="http://sd-stc.cz" rel="noreferrer" target="_blank">sd-stc.cz</a>]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_cmd] (0x2000): Using<br>
>protocol version [1]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sss_parse_name_for_domains]<br>
>(0x0200): name '<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>' matched expression for domain '<br>
><a href="http://sd-stc.cz" rel="noreferrer" target="_blank">sd-stc.cz</a>', user is simecek.tomas<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sss_parse_name_for_domains]<br>
>(0x0200): name '<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>' matched expression for domain '<br>
><a href="http://sd-stc.cz" rel="noreferrer" target="_blank">sd-stc.cz</a>', user is simecek.tomas<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_cmd_parse_query_done]<br>
>(0x0200): Requesting rules for [simecek.tomas] from [<a href="http://sd-stc.cz" rel="noreferrer" target="_blank">sd-stc.cz</a>]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sss_ncache_check_str] (0x2000):<br>
>Checking negative cache for [NCE/USER/<a href="http://sd-stc.cz/simecek.tomas" rel="noreferrer" target="_blank">sd-stc.cz/simecek.tomas</a>]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_user] (0x0200):<br>
>Requesting info about [<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_user] (0x0400):<br>
>Returning info for user [<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_rules] (0x0400):<br>
>Retrieving rules for [<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>] from [<a href="http://sd-stc.cz" rel="noreferrer" target="_blank">sd-stc.cz</a>]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sysdb_search_group_by_gid]<br>
>(0x0400): No such entry<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache]<br>
>(0x0200): Searching sysdb with<br>
>[(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=<br>
><a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>)(sudoUser=#988604700)(sudoUser=%domain\<br>
><a href="mailto:20users@sd-stc.cz" target="_blank">20users@sd-stc.cz</a>)(sudoUser=%<a href="mailto:unixadmins@sd-stc.cz" target="_blank">unixadmins@sd-stc.cz</a>)(sudoUser=%<br>
><a href="mailto:wifiadmins@sd-stc.cz" target="_blank">wifiadmins@sd-stc.cz</a>)(sudoUser=%grpunixadmins)(sudoUser=%<a href="mailto:mfcr_mfg@sd-stc.cz" target="_blank">mfcr_mfg@sd-stc.cz</a><br>
>)(sudoUser=+*))(&(dataExpireTimestamp<=1468482835)))]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_rules] (0x2000): About<br>
>to get sudo rules from cache<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sysdb_search_group_by_gid]<br>
>(0x0400): No such entry<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache]<br>
>(0x0200): Searching sysdb with<br>
>[(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a><br>
>)(sudoUser=#988604700)(sudoUser=%domain\<a href="mailto:20users@sd-stc.cz" target="_blank">20users@sd-stc.cz</a>)(sudoUser=%<br>
><a href="mailto:unixadmins@sd-stc.cz" target="_blank">unixadmins@sd-stc.cz</a>)(sudoUser=%<a href="mailto:wifiadmins@sd-stc.cz" target="_blank">wifiadmins@sd-stc.cz</a><br>
>)(sudoUser=%grpunixadmins)(sudoUser=%<a href="mailto:mfcr_mfg@sd-stc.cz" target="_blank">mfcr_mfg@sd-stc.cz</a>)(sudoUser=+*)))]<br>
>(Thu Jul 14 09:53:55 2016) [sssd[sudo]] [sudosrv_get_sudorules_from_cache]<br>
>(0x0400): Returning 0 rules for [<a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>]<br>
Your user does not have any valid sudo rules.<br>
It might be caused by wrong group membership.<br>
Are you sure that user <a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a> is member of group grpunixadmins<br>
<br>
BTW this is described in sudo troubleshooting wiki<br>
<br>
<a href="https://fedorahosted.org/sssd/wiki/HOWTO_Troubleshoot_SUDO" rel="noreferrer" target="_blank">https://fedorahosted.org/sssd/wiki/HOWTO_Troubleshoot_SUDO</a><br>
</div></div><span><font color="#888888"><br>
LS<br>
<br><span class="">
--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br>
</span></font></span></blockquote></div><br></div>
</blockquote></div><br></div>