<html> <head> <meta http-equiv="content-type" content="text/html; charset=utf-8"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hi, I have FreeIPA set up under CentOS 7. When I use freeipa-client to add an ubuntu 14.04 client it works fine (*). However when do the same with ubuntu 16.04, sudo always refuses to run: <tt>$ sudo -s</tt><tt> </tt><tt>[sudo] password for brian.candler:</tt><tt> </tt><tt>brian.candler is not allowed to run sudo on api-dev.int.example.com. This incident will be reported.</tt><tt> </tt> I have a simple one-entry sudo policy which says that for all users in groups X and Y, on all hosts, run all commands. (**) If I crank up sudo logging by setting this in /etc/sudo.conf: Debug sudo /var/log/sudo-debug all@info then on the working 14.04 machine I see ... various settings ... May 2 22:05:27 sudo[19175] settings: plugin_dir=/usr/lib/sudo/ May 2 22:05:27 sudo[19175] user_info: user=brian.candler May 2 22:05:27 sudo[19175] user_info: pid=19175 ... lots more user_info, perms, netgroups etc ... May 2 22:05:29 sudo[19175] policy plugin returns 1 ... but on the failing 16.04 machine I see only this: May 3 07:44:56 sudo[21118] will restore signal 13 on exec May 3 07:44:56 sudo[21118] comparing dev 34817 to /dev/pts/1: match! @ sudo_ttyname_dev() ./ttyname.c:336 May 3 07:44:56 sudo[21118] settings: run_shell=true May 3 07:44:56 sudo[21118] settings: progname=sudo May 3 07:44:56 sudo[21118] settings: network_addrs=x.x.x.x/255.255.255.0 xxxx:xxxx:xxxx:xxxx::230/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff fe80::1:xxxx:xxxx:xxxx/ffff:ffff:ffff:ffff:: May 3 07:44:56 sudo[21118] settings: plugin_dir=/usr/lib/sudo/ May 3 07:44:58 sudo[21118] policy plugin returns 0 That's all that gets logged - nothing more. It seems that a return of 0 means failure: <a class="moz-txt-link-freetext" href="https://www.sudo.ws/man/1.8.15/sudo_plugin.man.html">https://www.sudo.ws/man/1.8.15/sudo_plugin.man.html</a> "open() ... <meta charset="utf-8"> Returns 1 on success, 0 on failure, -1 if a general error occurred, or -2 if there was a usage error." But I have no idea what sort of failure or why. /var/log/auth.log shows: May 3 08:00:14 api-dev sudo: pam_unix(sudo:auth): authentication failure; logname=brian.candler uid=1211000003 euid=0 tty=/dev/pts/1 ruser=brian.candler rhost= user=brian.candler May 3 08:00:14 api-dev sudo: pam_sss(sudo:auth): authentication success; logname=brian.candler uid=1211000003 euid=0 tty=/dev/pts/1 ruser=brian.candler rhost= user=brian.candler May 3 08:00:14 api-dev sudo: brian.candler : user NOT in sudoers ; TTY=pts/1 ; PWD=/home/brian.candler ; USER=root ; COMMAND=/bin/bash (which shows I gave the correct FreeIPA password, but not why the sudoers lookup failed) I really can't see where else to look. Both machines have "sudo: files sss" in /etc/nsswitch.conf, and both have the same /etc/sssd/sssd.conf. Setting "sss_debuglevel 7" and "sss_cache -UG" shows a lot of noise but no obvious errors. I've also upgraded to the latest <meta charset="utf-8"> sudo_1.8.19-3_amd64.deb package from <a class="moz-txt-link-freetext" href="https://www.sudo.ws/download.html">https://www.sudo.ws/download.html</a>, but this makes no difference. Has anyone seen this problem before, or have some ideas where else to look? Thanks, Brian Candler. (*) In Ubuntu 14.04 I had to manually add sudo to the list of sssd services: <meta charset="utf-8"> <code style="font-family: monospace; color: rgb(51, 51, 51); font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">[sssd]</code><br style="color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;"> <code style="font-family: monospace; color: rgb(51, 51, 51); font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">services = nss, pam, ssh, sudo</code> <meta charset="utf-8"> but this was done automatically by freeipa-client in Ubuntu 16.04. (**) Therefore I'm pretty sure this is not the netgroups problem, for which the fix has been released anyway: <a class="moz-txt-link-freetext" href="https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/1607666">https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/1607666</a> </body> </html>