[Freeipa-users] Sudo configuration question

[Jan Zelený]

> On 12/20/2011 10:27 PM, Jan Zelený wrote:
> >> I have been working through configuring sudo via IPA and ran into the
> >> following situation.
> >> 
> >> There is a directive in the documentation to configure
> >> /etc/sssd/sssd.conf on the clients with something like the following:
> >> 
> >> ldap_netgroup_search_base = cn=ng,cn=compat,dc=example,dc=com
> >> 
> >> 
> >> This is pulled from the docse here for reference:
> >> http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identi
> >> ty_ Management_Guide/example-configuring-sudo.html
> >> 
> >> This is fine and causes no problems, however, when I mistakenly left it
> >> out on a few systems, sudo continued to function, so I am wondering what
> >> it is that this directive does? Does this get sssd into the loop to
> >> cache sudo rules for offline use?
> > 
> > Support for SUDO in SSSD has been added just about a week ago into master
> > branch and is considered experimental right now. And as I understand it,
> > the support in SUDO itself is still not entirely complete. So the simple
> > answer is: hang on, the support is coming.
> > 
> > Jan
> 
> Hmm, that is odd. I am not trying to be on the bleeding edge here, my
> sudo setup is taken directly from the RHEL 6.2 documentation concerning
> identity management. It would be very strange if RHEL was running such
> an experimental and bleeding edge thing in the base RHEL setup.

Of course, it's not even in Fedora yet. The documentation link you sent 
doesn't refer to SSSD but directly to sudo LDAP plugin which should be working 
as described there.

> So I guess to back up a bit here, IF sudo were working with SSSD as it
> will in the future would the aforementioned directive be the way to make
> it work. Understanding of course that for now it doesn't.

I assume you are referring to the SSSD search base directive. In that case the 
correct directive will be ldap_sudo_search_base. There are also 11 more 
directives which can be used to configure attribute names of LDAP sudo objects 
like ldap_sudorule_name, ldap_sudorule_command, etc.

Some configuration will be also needed for the entire chain to work. For 
example sudo responder config section will have to be set up. But let's not 
skip ahead, I'm sure everything will be well documented by the time when the 
sudo chain is stable.

I hope this answers your question. If you have any more questions please don't 
hesitate to ask.

Thanks
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20111221/19d6bf95/attachment.sig>