<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 06/06/2012 01:59 PM, Joe Linoff wrote: <blockquote cite="mid:8AD4194C251EC74CB897E261038F447801005C9F@mantaray.tabula.com" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 12 (filtered medium)"> <style></style> <div class="WordSection1"> Hi Folks:<o:p></o:p> <o:p> </o:p> I am trying to configure sudo clients using FreeIPA 2.1.3 on CentOS 6.2 but it I am running into a problem that I do not know how to debug. I used the instructions provided here: <a moz-do-not-send="true" href="http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/example-configuring-sudo.html">http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/example-configuring-sudo.html</a>. <o:p></o:p> <o:p> </o:p> The server installation went fine and I even did a sudo client installation on the server which worked well. Unfortunately, when I did the same client setup on another host in the network I got the message: <user> not in sudoers files when I tried to execute a command.<o:p></o:p> <o:p> </o:p> Here is the output from /var/log/secure on the client. I didn’t see anything strange on the server. The user name is bigbob.<o:p></o:p> <o:p> </o:p> Jun 6 10:38:35 docs unix_chkpwd[8737]: password check failed for user (bigbob)<o:p></o:p> Jun 6 10:38:35 docs sudo: pam_unix(sudo:auth): authentication failure; logname=bigbob uid=0 euid=0 tty=/dev/pts/2 ruser=bigbob rhost= user=bigbob<o:p></o:p> Jun 6 10:38:36 docs sudo: pam_sss(sudo:auth): authentication success; logname=bigbob uid=0 euid=0 tty=/dev/pts/2 ruser=bigbob rhost= user=bigbob<o:p></o:p> Jun 6 10:38:36 docs sudo: bigbob : user NOT in sudoers ; TTY=pts/2 ; PWD=/home/bigbob ; USER=root ; COMMAND=/bin/ls<o:p></o:p> Jun 6 10:44:09 docs unix_chkpwd[8767]: password check failed for user (bigbob)<o:p></o:p> Jun 6 10:44:09 docs sudo: pam_unix(sudo:auth): authentication failure; logname=bigbob uid=0 euid=0 tty=/dev/pts/2 ruser=bigbob rhost= user=bigbob<o:p></o:p> Jun 6 10:44:10 docs sudo: pam_sss(sudo:auth): authentication success; logname=bigbob uid=0 euid=0 tty=/dev/pts/2 ruser=bigbob rhost= user=bigbob<o:p></o:p> Jun 6 10:44:10 docs sudo: bigbob : user NOT in sudoers ; TTY=pts/2 ; PWD=/home/bigbob ; USER=root ; COMMAND=/bin/pwd<o:p></o:p> <o:p> </o:p> </div> </blockquote> Looks like sudo utility is not going over the ldap and tries to find user in the local file. Can you bind to the ldap server? Is firewall port open? <blockquote cite="mid:8AD4194C251EC74CB897E261038F447801005C9F@mantaray.tabula.com" type="cite"> <div class="WordSection1"> The command “/bin/pwd” is in the sudo commands and in the sudo command group.<o:p></o:p> <o:p> </o:p> Any help would be greatly appreciated.<o:p></o:p> <o:p> </o:p> Here are the setup steps that I performed on the client. The domain is foo.example.com.<o:p></o:p> <o:p> </o:p> # CITATION: <a moz-do-not-send="true" href="http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/example-configuring-sudo.html">http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/example-configuring-sudo.html</a> <o:p></o:p> <o:p> </o:p> # ================================================================<o:p></o:p> # Update /etc/nsswitch.conf<o:p></o:p> # ================================================================<o:p></o:p> cat >/etc/nsswitch.conf <<EOF<o:p></o:p> <o:p></o:p> # ================================================================<o:p></o:p> # FreeIPA sudo support<o:p></o:p> # ================================================================<o:p></o:p> sudoers: files ldap<o:p></o:p> sudoers_debug: 1<o:p></o:p> EOF<o:p></o:p> <o:p></o:p> # ================================================================<o:p></o:p> # Insert this just after the ipa_server line and restart sssd:<o:p></o:p> # ldap_netgroup_search_base = cn=ng,cn=compat,dc=foo,dc=example,dc=com<o:p></o:p> # ================================================================<o:p></o:p> cat /etc/sssd/sssd.conf | \<o:p></o:p> awk '{print $0;if($1=="ipa_server"){printf("ldap_netgroup_search_base = cn=ng,cn=compat,dc=foo,dc=example,dc=com\n");}}' >/tmp/x<o:p></o:p> cp /tmp/x /etc/sssd/sssd.conf<o:p></o:p> rm -f /tmp/x<o:p></o:p> service sssd restart<o:p></o:p> <o:p></o:p> # ================================================================<o:p></o:p> # Create the /etc/nslcd.conf file<o:p></o:p> # ================================================================<o:p></o:p> ls /etc/nslcd.conf<o:p></o:p> cat >/etc/nslcd.conf <<EOF<o:p></o:p> binddn uid=sudo,cn=sysaccounts,cn=etc,dc=foo,dc=example,dc=com<o:p></o:p> bindpw pwd/sudo<o:p></o:p> <o:p></o:p> ssl start_tls<o:p></o:p> tls_cacertfile /etc/ipa/ca.crt<o:p></o:p> tls_checkpeer yes<o:p></o:p> <o:p></o:p> bind_timelimit 5<o:p></o:p> timelimit 15<o:p></o:p> <o:p></o:p> uri <a class="moz-txt-link-freetext" href="ldap://cuthbert.foo.example.com">ldap://cuthbert.foo.example.com</a><o:p></o:p> sudoers_base ou=SUDOers,dc=foo,dc=example,dc=com<o:p></o:p> EOF<o:p></o:p> <o:p></o:p> # ================================================================<o:p></o:p> # Set the NIS domain name (even though NIS is not used)<o:p></o:p> # ================================================================<o:p></o:p> nisdomainname foo.example.com<o:p></o:p> <o:p> </o:p> Thank you,<o:p></o:p> <o:p> </o:p> Joe<o:p></o:p> <o:p> </o:p> <o:p> </o:p> </div> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>