<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> <o:p> </o:p> That didn’t work either. I set up the host group in my sudo rule, stopped sssd, renamed /var/lib/sss/db and created a new db directory, then restarted sssd. New files were created in the db directory, but it still refuses to work unless the hosts are directly specified in the sudo rule.<o:p></o:p> Thanks,<o:p></o:p> -Mark<o:p></o:p> <o:p> </o:p> <div> <o:p> </o:p> ________________________________________________________________<o:p></o:p> Mark Tovey - UNIX Engineer | Service Strategy & Design<o:p></o:p> <a href="http://www.go2uti.com/">UTi</a> | 400 SW Sixth Ave, Suite 1100 | Portland | Oregon | 97204 | USA<o:p></o:p> <a href="mailto:MTovey@go2uti.com">MTovey@go2uti.com</a> | O / C +1 503 953-1389 | Skype: mark.tovey2<o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Steven Jones [mailto:Steven.Jones@vuw.ac.nz] Sent: Monday, July 15, 2013 4:15 PM To: Tovey, Mark; James Hogarth Cc: Freeipa-users@redhat.com Subject: RE: [Freeipa-users] sudo rules user and host group bugs?<o:p></o:p> </div> </div> <o:p> </o:p> <div> Hi, This is a known issue Ive suffered a long time with. What would be interesting is adding another host to the host group could well work fine, that will really make you bang your head against the wall.. 2 possibilities, stop the sssd daemon on the problem host, delete its cache and start it, that might fix it. Otherwise best to, All RH support could come up with is delete the HBAC rule, sudo rule, user group and host group and re-do it, then it will probably work fine.<o:p></o:p> <div> <o:p> </o:p> <div> regards<o:p></o:p> Steven Jones<o:p></o:p> Technical Specialist - Linux RHCE<o:p></o:p> Victoria University, Wellington, NZ<o:p></o:p> 0064 4 463 6272<o:p></o:p> </div> </div> <div> <div class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="100%" align="center"> </div> <div id="divRpF323344"> From: <a href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [freeipa-users-bounces@redhat.com] on behalf of Tovey, Mark [MTovey@go2uti.com] Sent: Tuesday, 16 July 2013 10:54 a.m. To: James Hogarth Cc: <a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] sudo rules user and host group bugs?<o:p></o:p> </div> <div> <div> <o:p></o:p> <o:p></o:p> I checked that and it is set correctly:<o:p></o:p> <o:p></o:p> [user1@host1 ~]$ nisdomainname<o:p></o:p> my_domain.com<o:p></o:p> <o:p></o:p> If I try to run a command with the hosts specified indirectly through a host group, it fails:<o:p></o:p> <o:p></o:p> [user1@host1 ~]$ sudo -i -u serv_account<o:p></o:p> LDAP Config Summary<o:p></o:p> ===================<o:p></o:p> uri ldap://ipa_server.my_domain.com<o:p></o:p> ldap_version 3<o:p></o:p> sudoers_base ou=SUDOers,dc=my_domain,dc=com<o:p></o:p> binddn uid=sudo,cn=sysaccounts,cn=etc,dc=my_domain,dc=com<o:p></o:p> bindpw **********<o:p></o:p> bind_timelimit 5000<o:p></o:p> timelimit 15<o:p></o:p> ssl start_tls<o:p></o:p> tls_checkpeer (yes)<o:p></o:p> tls_cacertfile /etc/ipa/ca.crt<o:p></o:p> ===================<o:p></o:p> sudo: ldap_initialize(ld, ldap://ipa_server.my_domain.com)<o:p></o:p> sudo: ldap_set_option: debug -> 0<o:p></o:p> sudo: ldap_set_option: ldap_version -> 3<o:p></o:p> sudo: ldap_set_option: tls_checkpeer -> 1<o:p></o:p> sudo: ldap_set_option: tls_cacertfile -> /etc/ipa/ca.crt<o:p></o:p> sudo: ldap_set_option: timelimit -> 15<o:p></o:p> sudo: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT, 5)<o:p></o:p> <o:p></o:p> sudo: ldap_start_tls_s() ok<o:p></o:p> sudo: ldap_sasl_bind_s() ok<o:p></o:p> sudo: no default options found!<o:p></o:p> sudo: ldap search '(|(sudoUser=user1)(sudoUser=%user1)(sudoUser=%user1s)(sudoUser=ALL))'<o:p></o:p> sudo: found:cn=my_sudo_rule,ou=sudoers,dc=my_domain,dc=com<o:p></o:p> sudo: ldap sudoHost '+hgroup1' ... not<o:p></o:p> sudo: ldap search 'sudoUser=+*'<o:p></o:p> sudo: user_matches=1<o:p></o:p> sudo: host_matches=0<o:p></o:p> sudo: sudo_ldap_lookup(0)=0x40<o:p></o:p> [sudo] password for user1:<o:p></o:p> Sorry, try again.<o:p></o:p> [sudo] password for user1:<o:p></o:p> sudo: 1 incorrect password attempt<o:p></o:p> <o:p></o:p> <o:p></o:p> But if I remove the host group from the sudo rule and directly add the hosts that were in the host group, it works fine:<o:p></o:p> <o:p></o:p> <snip><o:p></o:p> <o:p></o:p> sudo: ldap_start_tls_s() ok<o:p></o:p> sudo: ldap_sasl_bind_s() ok<o:p></o:p> sudo: no default options found!<o:p></o:p> sudo: ldap search '(|(sudoUser=user1)(sudoUser=%user1)(sudoUser=%user1s)(sudoUser=ALL))'<o:p></o:p> sudo: found:cn=my_sudo_rule,ou=sudoers,dc=my_domain,dc=com<o:p></o:p> sudo: ldap sudoHost 'host1.my_domain.com' ... MATCH!<o:p></o:p> sudo: ldap sudoRunAsUser 'serv_account' ... MATCH!<o:p></o:p> sudo: ldap sudoCommand 'ALL' ... MATCH!<o:p></o:p> sudo: Command allowed<o:p></o:p> sudo: user_matches=1<o:p></o:p> sudo: host_matches=1<o:p></o:p> sudo: sudo_ldap_lookup(0)=0x02<o:p></o:p> [sudo] password for user1:<o:p></o:p> [serv_account@host1 ~]$<o:p></o:p> <o:p></o:p> <o:p></o:p> So something isn’t lining up correctly with host groups in sudo rules somewhere. I just haven’t been able to track it down.<o:p></o:p> Thanks,<o:p></o:p> -Mark<o:p></o:p> <o:p></o:p> <o:p></o:p> <o:p></o:p> ________________________________________________________________<o:p></o:p> Mark Tovey - UNIX Engineer | Service Strategy & Design<o:p></o:p> <a href="http://www.go2uti.com/" target="_blank">UTi</a> | 400 SW Sixth Ave, Suite 1100 | Portland | Oregon | 97204 | USA<o:p></o:p> <a href="mailto:MTovey@go2uti.com" target="_blank">MTovey@go2uti.com</a> | O / C +1 503 953-1389 | Skype: mark.tovey2<o:p></o:p> <o:p></o:p> From: James Hogarth [<a href="mailto:james.hogarth@gmail.com">mailto:james.hogarth@gmail.com</a>] Sent: Monday, July 15, 2013 1:11 PM To: Tovey, Mark Subject: Re: [Freeipa-users] sudo rules user and host group bugs?<o:p></o:p> <o:p></o:p> > > > Did anyone find a solution for this? I am having the same experience. > > ><o:p></o:p> Wow that was a mess...<o:p></o:p> To use hostgroups for sudo ensure nisdomainname is set on the hosts to the IPA domain.<o:p></o:p> </div> </div> </div> </div> </div> </body> </html>