<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div>Hi Stephen,</div><div><br></div><div> That's very helpful. Thanks a lot.</div><div><br></div><div>--Gelen</div><div><br></div> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Stephen Ingram <sbingram@gmail.com><br> <b><span style="font-weight: bold;">To:</span></b> Gelen James <hahaha_30k@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "freeipa-users@redhat.com" <freeipa-users@redhat.com>; Rob Crittenden <rcritten@redhat.com>; Rich Megginson <rmeggins@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, May
18, 2012 2:58 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] sudo rules in IPA infrastructure<br> </font> </div> <br>
On Fri, May 18, 2012 at 2:35 PM, Gelen James <<a ymailto="mailto:hahaha_30k@yahoo.com" href="mailto:hahaha_30k@yahoo.com">hahaha_30k@yahoo.com</a>> wrote:<br>> Hi all,<br>><br>> Are the sudo rules applied to IPA clients through nss_ldap, instead of<br>> sssd?<br>><br>> I tried that on Redhat 6.2 clients, and some documents said that sudo rules<br>> would work when enabled inside /etc/nslcd.conf, but we need to hack the<br>> script /etc/init.d/nslcd.conf a little bit -- basically to mess around the<br>> sudo config statement before/after nslcd daemon runs as the latter still can<br>> not handle sudo statements very well.<br><br>I just got sudo setup on 6.2. You do use /etc/nslcd.conf, but you<br>don't have to install the nslcd daemon to get it working. It just<br>looks to that file for the config. So remove nslcd and then just<br>create the /etc/nslcd.conf from scratch and put in what they specify<br>on the
documentation. Make all of the other changes they mention and<br>it will just work!<br><br>> Then on 5.8, where nslcd daemon is not available, should we edit<br>> /etc/ldap.conf for nss_ldap and how? Please shed a light on this. Thanks a<br>> lot.<br><br>Type sudo -V to be sure, but look for the ldap.conf path (on my 5.8 it<br>is /etc/ldap.conf). I haven't set this up yet, but I assume that you<br>can just add the config mentioned in the docs to ldap.conf along with<br>all of the other changes and you're off. As it worked perfectly on<br>6.2, I'm guessing it will also work on 5.8.<br><br>You can look through bugzilla and see the various discussions about<br>all of this, but suffice it to say there has been a fair amount of<br>discussion as to where to locate this sudo ldap config. I think it is<br>headed for /etc/ldap.sudo or something like that in 6.3, but as long<br>as you put it where sudo is looking for it, everything should
work.<br><br>If you still can't get it to work, Adam Young has written a script<br>that you can look at to explain the process:<br>http://adam.younglogic.com/2011/03/centralized-sudo-with-freeipa/.<br><br>Steve<br><br><br> </div> </div> </div></body></html>