<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Can you turn on debugging?<br>
<br>
"sudoers_debug 2"<br>
<br>
to /etc/sudo-ldap.conf (assumes RHEL6.3)<br>
<br>
Also you could try adding the host directly to the sudo rule and not via a host group as that seems buggy....<br>
<div><br>
<div style="font-family: Tahoma; font-size: 13px;">
<p>regards</p>
<p>Steven Jones</p>
<p>Technical Specialist - Linux RHCE</p>
<p>Victoria University, Wellington, NZ</p>
<p>0064 4 463 6272<br>
</p>
</div>
</div>
<div style="font-family: Times New Roman; color: rgb(0, 0, 0); font-size: 16px;">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF856379"><font color="#000000" face="Tahoma" size="2"><b>From:</b> freeipa-users-bounces@redhat.com [freeipa-users-bounces@redhat.com] on behalf of Toasted Penguin [toastedpenguininfo@gmail.com]<br>
<b>Sent:</b> Wednesday, 17 October 2012 10:24 a.m.<br>
<b>To:</b> freeipa-users@redhat.com<br>
<b>Subject:</b> [Freeipa-users] Setting up sudo in FreeIPA v2.2<br>
</font><br>
</div>
<div></div>
<div>
<div>I have the server setup to manage sudo and I configured a target client to use the IPA server for sudo. When a user tries to use sudo (in this case "sudo su -") it fails and they get the error "user is not allowed to run sudo on client-host. This incident
will be reported." I verified via the log files that the client is making requests to the IPA server when the user is attemping to use sudo and it fails. I temporarily disabled using the IPA server for sudo and I get the standard "User not in the sudoers
file...." </div>
<div> </div>
<div>Its starting to look like the server rules maybe the issue but I believe I have the sudo rule setup correctly. I created a sudo command "/bin/su", created a sudo rule "Sudo to root" , added the group the user in question is a part of to the WHO-->User
Groups; Added the Host Group the target client host is part of to Access This Host-->Host Groups and added the sudo command to the sudo rule via Allow-->Sudo Allow Commands. When I delete the sudo rule I get the same result as I did when I temporarily disbled
the client host using tghe IPA server for sudo verification.</div>
<div> </div>
<div>Any ideas why or where to look to figure out this issue?</div>
<div> </div>
<div>Thanks,</div>
<div>David </div>
</div>
</div>
</div>
</body>
</html>