[Freeipa-users] SOLVED: Re: sudo rule working even after the user has been removed from the sudo rule

[Rajnesh Kumar Siwal]

Looking into the sssd logs, I came to know there there was one more
rule allowing access:-
(Mon Feb  4 14:13:01 2013) [sssd[be[chargepoint.dmz]]]
[hbac_get_category] (5): Category is set to 'all'.
(Mon Feb  4 14:13:01 2013) [sssd[be[chargepoint.dmz]]]
[ipa_hbac_evaluate_rules] (3): Access granted by HBAC rule [allow_all]
(Mon Feb  4 14:13:01 2013) [sssd[be[chargepoint.dmz]]]
[be_pam_handler_callback] (4): Backend returned: (0, 0, <NULL>)
[Success]

I disabled that allow_all rule, now it is fine.

On Mon, Feb 4, 2013 at 2:02 PM, Rajnesh Kumar Siwal
<rajnesh.siwal at gmail.com> wrote:
> Here is the outuput of ldapsearch :-
> dn: cn=Admins,ou=sudoers,dc=example,dc=com
> objectClass: sudoRole
> sudoUser: %ctsadmin
> sudoHost: ALL
> sudoCommand: ALL
> sudoRunAsUser: ALL
> cn: Admins
>
> The rule still says that the group ctsadmin is allowed (Which should
> not happen after I remove the ctsadmin group from sudo access)
> On the IPA Web Interface there is not sudo role attached to the  User
> "rsiwal" (Neither Direct nor Indirect).
> May be there is some bug.
>
>
> On Mon, Feb 4, 2013 at 1:22 PM, Rajnesh Kumar Siwal
> <rajnesh.siwal at gmail.com> wrote:
>> Hi all,
>>
>> I have just created a setup for sudo on the IPA Server 2.2.
>> I modified nsswitch.conf to use ldap.
>> ldap.conf has been modified to fetch sudo users from the IPA Server.
>>
>> Now, th euser in group "admin" can do sudo.
>>       1. rsiwal being a user of group sudo can run all commands as sudo (FINE)
>>       2. If I disable the rule "Admins" (that I admin group access to
>> sudo), the sudo still works for the user rsiwal (Which should not work
>> logically).
>>       3. Removed the group "Admins" (including rsiwal) from the Sudo
>> rule. The rule is still allowing user rsiwal to run "sudo su -". (It
>> should Fail)
>>
>> Is there some kind of caching being at the Server / client end ?
>>
>> --
>> Regards,
>> Rajnesh Kumar Siwal
>
>
>
> --
> Regards,
> Rajnesh Kumar Siwal



-- 
Regards,
Rajnesh Kumar Siwal