[Freeipa-users] FreeIPA, version: 4.1.0 and sudo configuration

[Chamambo Martin]

I have done below and its giving me the correct results and at the moment
LET ME enable debugging in sudo itself and see if that will get me somewhere

[root at ironhide ~]# getent netgroup mailservers 
mailservers           (ironhide.ai.co.zw,-,ai.co.zw)
(alvin.ai.co.zw,-,ai.co.zw) (madagascar.ai.co.zw,-,ai.co.zw)
(nemo.ai.co.zw,-,ai.co.zw)
[root at ironhide ~]# 





-----Original Message-----
From: Jakub Hrozek [mailto:jhrozek at redhat.com] 
Sent: Wednesday, April 08, 2015 10:35 AM
To: Chamambo Martin
Cc: freeipa-users at redhat.com; 'Lukas Slebodnik'
Subject: Re: [Freeipa-users] FreeIPA, version: 4.1.0 and sudo configuration

On Wed, Apr 08, 2015 at 10:17:59AM +0200, Chamambo Martin wrote:
> I have this log after doing a debug_level=6 in the sudo section and 
> have attached a txt file for the ldbsearch -H 
> /var/lib/sss/db/cache_ai.co.zw.ldb
> 

> (Wed Apr  8 10:14:52 2015) [sssd[sudo]] 
> [sudosrv_get_sudorules_query_cache]
> (0x0200): Searching sysdb with
> [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=admi
> n)(sud oUser=#1468200000)(sudoUser=%admins)(sudoUser=%trust
> admins)(sudoUser=%admins)(sudoUser=+*))(&(dataExpireTimestamp<=1428480
> 892)))
> ]
> (Wed Apr  8 10:14:52 2015) [sssd[sudo]] 
> [sudosrv_get_sudorules_query_cache]
> (0x0200): Searching sysdb with
> [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=admin)(sudoUser=#14
> 682000
> 00)(sudoUser=%admins)(sudoUser=%trust
> admins)(sudoUser=%admins)(sudoUser=+*)))]

The above are the cache searches sssd ran.

This is how the sudo rule looks in your cache:
# record 29

dn: name=file-commands,cn=sudorules,cn=custom,cn=ai.co.zw,cn=sysdb

cn: file-commands

dataExpireTimestamp: 1428486013

entryUSN: 28714

name: file-commands

objectClass: sudoRule

originalDN: cn=file-commands,ou=sudoers,dc=ai,dc=co,dc=zw

sudoCommand: /usr/bin/vim

sudoCommand: /usr/bin/less

sudoHost: +mailservers

sudoRunAsGroup: ALL

sudoRunAsUser: admin

sudoRunAsUser: chamambom

sudoRunAsUser: kamoyob

sudoRunAsUser: kumalop

sudoRunAsUser: machangeteb

sudoRunAsUser: masaitit

sudoRunAsUser: masvivic

sudoRunAsUser: matangiraa

sudoRunAsUser: nyahumap

sudoRunAsUser: pedzisail

sudoRunAsUser: tayengwaj

sudoUser: ALL

distinguishedName:
name=file-commands,cn=sudorules,cn=custom,cn=ai.co.zw,cn=sy

 sdb

> (Wed Apr  8 10:14:52 2015) [sssd[sudo]] 
> [sudosrv_get_sudorules_from_cache]
> (0x0400): Returning 1 rules for [admin at ai.co.zw]

And here we see that the sudo rule was returned from SSSD to sudo. But then
in sudo, it didn't match for some reason. I expect it's because of the
netgroup, can you check if nisdomainname is really set correctly and getent
netgroup mailservers reports the FQDN of your client?

Also, you can enable debugging in sudo itself. See man sudo.conf and search
for the option "Debug". That will show you how exactly sudo matches the
rules.


> (Wed Apr  8 10:15:02 2015) [sssd[sudo]] [client_recv] (0x0200): Client 
> disconnected!