[Freeipa-users] RHEL 6.3 identity manual - IPA

[Stephen Ingram]

On Thu, Aug 23, 2012 at 2:26 PM, Steven Jones <Steven.Jones at vuw.ac.nz> wrote:
> Some notes on the identity manual which says its for RHEl6,
>
> "13.4.2. Client Configuration for sudo Rules This example specifically
> configures a Red Hat Enterprise Linux 6 client for sudo rules.
>
> 8><----
>
> 2. Enable debug logging for sudo operations in the /etc/ldap.conf file. If
> this file does not exist, it can be created. vim /etc/ldap.conf
> sudoers_debug:
>
> It seems for a RHEL6 client its /etc/sudo-ldap.conf
>
> ditto 4.
>
> Edit the NSS/LDAP configuration file and add the following sudo-related
> lines to the
> /etc/nslcd.conf file:
> binddn uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
> bindpw sudo_password
> ssl start_tls
> tls_cacertfile /etc/ipa/ca.crt
> tls_checkpeer yes
> bind_timelimit 5
> timelimit 15
> uri ldap://ipaserver.example.com ldap://backup.example.com:3890
> sudoers_base ou=SUDOers,dc=example,dc=com
>
> It seems for a RHEL6 client its /etc/sudo-ldap.conf
>
> So it that section referring to RHEL5?

Most likely. /etc/sudo-ldap.conf is new with RHEL 6.3. Before that
(6.0-6.2) you had to use /etc/nslcd.conf. RHEL 5 series used a
different configuration altogether. I think that will eventually
change to as this becomes handled directly by sssd. Not a moment too
soon if you ask me. There are so many competing ways to set this up,
each with varying advantages and disadvantages. This is probably why
RH decided to just write sssd from scratch such that they could handle
all of the existing setups as well as new stuff like laptops out of
the office that need cached credentials and such.

Steve