<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 10/08/2012 06:04 PM, Sigbjorn Lie wrote: <blockquote cite="mid:50734DE8.1090802@nixtra.com" type="cite"> <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> Hi, </blockquote> Thank you for the report! <blockquote cite="mid:50734DE8.1090802@nixtra.com" type="cite"> I've been testing the sudo integration with IPA and I came across some questions: 1. When I disable or delete a sudo rule, it's not removed from the ou=sudoers until I restart the directory server. Am I doing something wrong? (389-ds-base-1.2.10.2-20.el6_3.x86_64, slapi-nis-0.40-1.el6.x86_64) </blockquote> This might be a bug in the compat plugin. The internal tree is reflected into the standard sudo schema that is supposed to be kept in sync with the internal tree. However I would be surprised if there is actually a bug. <blockquote cite="mid:50734DE8.1090802@nixtra.com" type="cite"> 2. Perhaps the documentation should mention creating a rule called "defaults" to put default options for all sudo rules in. Or even better having one created by default with a fresh IPA installation. It took me a few seconds to figure out where to put default options for all sudo rules. </blockquote> Can you please open an RFE in trac? <a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa">https://fedorahosted.org/freeipa</a> <blockquote cite="mid:50734DE8.1090802@nixtra.com" type="cite"> 3. sudo integration with SSSD does not work when anonymous LDAP authentication is disabled at the server. Enabling verbose logging in SSSD seem to suggest that it's attempting anonymous auth only. (sssd-1.8.4-14.fc17.x86_64) </blockquote> Which integration you are trying? The one that was tech preview in 1.8? The one that makes SSSD cache sudo rules? It was significantly rewritten in 1.9. Can you please try with 1.9? <blockquote cite="mid:50734DE8.1090802@nixtra.com" type="cite"> 4. Having spaces in sudo options (such as "env_keep = 'ENV_VAR'") make sudo display these options as errors when sudo debugging is enabled (sudoers_debug 1 in /etc/ldap.conf or /etc/sudo-ldap.conf): sudo: unknown defaults entry `env_keep ' </blockquote> Yes. This is a known issue already filed as a ticket. <blockquote cite="mid:50734DE8.1090802@nixtra.com" type="cite"> 5. It would be great to have a set of sudo commands and a set of sudo command groups installed by default. </blockquote> Can you make a proposal about what groups would you like to see in an RFE? <a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa">https://fedorahosted.org/freeipa</a> <blockquote cite="mid:50734DE8.1090802@nixtra.com" type="cite"> 6. Adding a sudo command having multiple commands listed (such as: "<a moz-do-not-send="true" href="https://lieipa01.ix.nixtra.com/ipa/ui/#/sbin/route,%20/sbin/ifconfig,%20/bin/ping,%20/sbin/dhclient,%20/usr/bin/net,%20/sbin/iptables,%20/usr/bin/%20rfcomm,%20/usr/bin/wvdial,%20/sbin/iwconfig,%20/sbin/mii-tool">/sbin/route, /sbin/ifconfig, /bin/ping</a>") is allowed in IPA and does list it correctly as allowed commands when doing "sudo -l", however attempting to execute one of the commands in the list using sudo fails. </blockquote> Can you please try SSSD 1.9? <blockquote cite="mid:50734DE8.1090802@nixtra.com" type="cite"> I did my testing with IPA server 2.2 in CentOS 6.3. Regards, Siggi <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>