Hello,<br><br>I'm experiencing an issue with sudo-ldap:<br>I have some commands defined in a rule, have granted permissions to my user to execute them via sudo following the docs:<br><div class="container">
<div id="paste_border">
<pre class="paste_scroller"><div id="paste_container"><ol class="paste_lines"><li id="1" class="lineno"><div class="paste_content"># ipa sudorule-show networking-commands</div></li><li id="2" class="lineno"><div class="paste_content">
Rule name: networking-commands</div></li><li id="3" class="lineno"><div class="paste_content"> Enabled: TRUE</div></li><li id="4" class="lineno"><div class="paste_content"> Users: dsastrem</div></li><li id="5" class="lineno special">
<div class="paste_content"> Host Groups: des</div></li><li id="6" class="lineno"><div class="paste_content"> Sudo Allow Command Groups: networking</div></li><li id="7" class="lineno"><div class="paste_content"> </div></li>
<li id="8" class="lineno"><div class="paste_content"># ipa sudocmdgroup-show networking</div></li><li id="9" class="lineno"><div class="paste_content"> Sudo Command Group: networking</div></li><li id="10" class="lineno special">
<div class="paste_content"> Description: commands for network configuration and troubleshooting</div></li><li id="11" class="lineno"><div class="paste_content"> Member Sudo commands: /sbin/route, /sbin/ifconfig, /sbin/iptables, /sbin/mii-tool, /sbin/ethtool, /sbin/ip</div>
</li><li id="12" class="lineno"><div class="paste_content"> </div></li><li id="13" class="lineno"><div class="paste_content">/etc/nsswitch.conf</div></li><li id="14" class="lineno"><div class="paste_content">==================</div>
</li><li id="15" class="lineno special"><div class="paste_content">passwd: files sss</div></li><li id="16" class="lineno"><div class="paste_content">shadow: files sss</div></li><li id="17" class="lineno"><div class="paste_content">
group: files sss</div></li><li id="18" class="lineno"><div class="paste_content">hosts: files dns</div></li><li id="19" class="lineno"><div class="paste_content">bootparams: nisplus [NOTFOUND=return] files</div>
</li><li id="20" class="lineno special"><div class="paste_content">ethers: files</div></li><li id="21" class="lineno"><div class="paste_content">netmasks: files</div></li><li id="22" class="lineno"><div class="paste_content">
networks: files</div></li><li id="23" class="lineno"><div class="paste_content">protocols: files</div></li><li id="24" class="lineno"><div class="paste_content">rpc: files</div></li><li id="25" class="lineno special">
<div class="paste_content">services: files sss</div></li><li id="26" class="lineno"><div class="paste_content">netgroup: files sss</div></li><li id="27" class="lineno"><div class="paste_content">publickey: nisplus</div>
</li><li id="28" class="lineno"><div class="paste_content">automount: files</div></li><li id="29" class="lineno"><div class="paste_content">aliases: files nisplus</div></li><li id="30" class="lineno special"><div class="paste_content">
sudoers: files ldap sss</div></li><li id="31" class="lineno"><div class="paste_content"> </div></li><li id="32" class="lineno"><div class="paste_content">/etc/sudo-ldap.conf</div></li><li id="33" class="lineno"><div class="paste_content">
===================</div></li><li id="34" class="lineno"><div class="paste_content">uri ldap://<a href="http://panoramix.some.domain.com">panoramix.some.domain.com</a></div></li><li id="35" class="lineno special"><div class="paste_content">
sudoers_base ou=SUDOers,dc=some,dc=domain,dc=com</div></li><li id="36" class="lineno"><div class="paste_content">bind_timelimit 5</div></li><li id="37" class="lineno"><div class="paste_content">timelimit 15</div></li><li id="38" class="lineno">
<div class="paste_content">binddn uid=sudo,cn=sysaccounts,cn=etc,dc=some,dc=domain,dc=com</div></li><li id="39" class="lineno"><div class="paste_content">bindpw secret</div></li><li id="40" class="lineno special"><div class="paste_content">
ssl start_tls</div></li><li id="41" class="lineno"><div class="paste_content">tls_cacertfile /etc/ipa/ca.crt</div></li><li id="42" class="lineno"><div class="paste_content">tls_checkpeer yes</div></li><li id="43" class="lineno">
<div class="paste_content"> </div></li><li id="44" class="lineno"><div class="paste_content">/etc/rc.local</div></li><li id="45" class="lineno special"><div class="paste_content">=============</div></li><li id="46" class="lineno">
<div class="paste_content">touch /var/lock/subsys/local</div></li><li id="47" class="lineno"><div class="paste_content">nisdomainname <a href="http://some.domain.com">some.domain.com</a></div></li></ol></div></pre>
</div>
</div>All three config files are equal in several hosts, but sudo is failing from one hosts in this way:<br>Pam_tally2 count gets increased with failed attempts, but the password is (obviously) the same (my kerberos passwd)<br>
<div class="container">
<div id="paste_border">
<pre class="paste_scroller"><div id="paste_container"><ol class="paste_lines"><li id="1" class="lineno"><div class="paste_content">dsastrem@obelix ~</div></li><li id="2" class="lineno"><div class="paste_content">$ sudo ip addr show</div>
</li><li id="3" class="lineno"><div class="paste_content">LDAP Config Summary</div></li><li id="4" class="lineno"><div class="paste_content">===================</div></li><li id="5" class="lineno special"><div class="paste_content">
uri ldap://<a href="http://panoramix.some.domain.com">panoramix.some.domain.com</a></div></li><li id="6" class="lineno"><div class="paste_content">ldap_version 3</div></li><li id="7" class="lineno"><div class="paste_content">
sudoers_base ou=SUDOers,dc=some,dc=domain,dc=com</div></li><li id="8" class="lineno"><div class="paste_content">binddn uid=sudo,cn=sysaccounts,cn=etc,dc=some,dc=domain,dc=com</div></li><li id="9" class="lineno">
<div class="paste_content">bindpw secret</div></li><li id="10" class="lineno special"><div class="paste_content">bind_timelimit 5000</div></li><li id="11" class="lineno"><div class="paste_content">timelimit 15</div>
</li><li id="12" class="lineno"><div class="paste_content">ssl start_tls</div></li><li id="13" class="lineno"><div class="paste_content">tls_checkpeer (yes)</div></li><li id="14" class="lineno"><div class="paste_content">
tls_cacertfile /etc/ipa/ca.crt</div></li><li id="15" class="lineno special"><div class="paste_content">===================</div></li><li id="16" class="lineno"><div class="paste_content">sudo: ldap_set_option: debug -> 0</div>
</li><li id="17" class="lineno"><div class="paste_content">sudo: ldap_set_option: tls_checkpeer -> 1</div></li><li id="18" class="lineno"><div class="paste_content">sudo: ldap_set_option: tls_cacertfile -> /etc/ipa/ca.crt</div>
</li><li id="19" class="lineno"><div class="paste_content">sudo: ldap_set_option: tls_cacert -> /etc/ipa/ca.crt</div></li><li id="20" class="lineno special"><div class="paste_content">sudo: ldap_initialize(ld, ldap://<a href="http://panoramix.some.domain.com">panoramix.some.domain.com</a>)</div>
</li><li id="21" class="lineno"><div class="paste_content">sudo: ldap_set_option: ldap_version -> 3</div></li><li id="22" class="lineno"><div class="paste_content">sudo: ldap_set_option: timelimit -> 15</div></li><li id="23" class="lineno">
<div class="paste_content">sudo: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT, 5)</div></li><li id="24" class="lineno"><div class="paste_content">sudo: ldap_start_tls_s() ok</div></li><li id="25" class="lineno special"><div class="paste_content">
sudo: ldap_sasl_bind_s() ok</div></li><li id="26" class="lineno"><div class="paste_content">sudo: no default options found in ou=SUDOers,dc=some,dc=domain,dc=com</div></li><li id="27" class="lineno"><div class="paste_content">
sudo: ldap search '(|(sudoUser=dsastrem)(sudoUser=%dsastrem)(sudoUser=%admins)(sudoUser=ALL))'</div></li><li id="28" class="lineno"><div class="paste_content">sudo: found:cn=networking-commands,ou=sudoers,dc=some,dc=domain,dc=com</div>
</li><li id="29" class="lineno"><div class="paste_content">sudo: ldap sudoHost '+des' ... MATCH!</div></li><li id="30" class="lineno special"><div class="paste_content">sudo: ldap sudoCommand '/sbin/route' ... not</div>
</li><li id="31" class="lineno"><div class="paste_content">sudo: ldap sudoCommand '/sbin/ifconfig' ... not</div></li><li id="32" class="lineno"><div class="paste_content">sudo: ldap sudoCommand '/sbin/iptables' ... not</div>
</li><li id="33" class="lineno"><div class="paste_content">sudo: ldap sudoCommand '/sbin/mii-tool' ... not</div></li><li id="34" class="lineno"><div class="paste_content">sudo: ldap sudoCommand '/sbin/ethtool' ... not</div>
</li><li id="35" class="lineno special"><div class="paste_content">sudo: ldap sudoCommand '/sbin/ip' ... MATCH!</div></li><li id="36" class="lineno"><div class="paste_content">sudo: Command allowed</div></li><li id="37" class="lineno">
<div class="paste_content">sudo: user_matches=1</div></li><li id="38" class="lineno"><div class="paste_content">sudo: host_matches=1</div></li><li id="39" class="lineno"><div class="paste_content">sudo: sudo_ldap_lookup(0)=0x02</div>
</li><li id="40" class="lineno special"><div class="paste_content">[sudo] password for dsastrem:</div></li><li id="41" class="lineno"><div class="paste_content">Sorry, try again.</div></li><li id="42" class="lineno"><div class="paste_content">
[sudo] password for dsastrem:</div></li><li id="43" class="lineno"><div class="paste_content">sudo: 1 incorrect password attempt</div></li><li id="44" class="lineno"><div class="paste_content"> </div></li><li id="45" class="lineno special">
<div class="paste_content"># pam_tally2 -u dsastrem</div></li><li id="46" class="lineno"><div class="paste_content">Login Failures Latest failure From</div></li><li id="47" class="lineno"><div class="paste_content">
dsastrem 2 09/26/12 17:22:54 /dev/pts/1</div></li></ol></div></pre>
</div>
</div>Any idea of what could be wrong? Thanks in advance.<br>