<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
ok sorry.<br>
<div class="moz-cite-prefix">On 29-08-2014 11:27, Jakub Hrozek
wrote:<br>
</div>
<blockquote cite="mid:20140829082719.GS3139@hendrix.brq.redhat.com"
type="cite">
<pre wrap="">On Fri, Aug 29, 2014 at 09:30:55AM +0300, Tevfik Ceydeliler wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
Here is my configuration adn client output. I dont know what is wrong
</pre>
</blockquote>
<pre wrap="">
Please keep the freeipa-users list in the CC list; other users might run
into the same problem.
</pre>
<blockquote type="cite">
<pre wrap="">=======================================================
Server Side:
[root@srv ~]# ipa sudorule-find
-------------------
1 Sudo Rule matched
-------------------
Rule name: log-reading
Enabled: TRUE
Users: kduser1, user1
Hosts: clnt2.ipa.grp, clnt.ipa.grp
Sudo Allow Commands: /usr/bin/less, /usr/bin/vi, /usr/bin/yum,
/usr/bin/apt-
get
Sudo Option: !authenticate
----------------------------
Number of entries returned 1
----------------------------
And client side:
1. nsswitch.con:
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
passwd: compat sss
group: compat sss
shadow: compat
hosts: files mdns4_minimal [NOTFOUND=return] dns
networks: files
protocols: sss files
services: sss files
ethers: sss files
rpc: sss files
netgroup: nis sss
sudoers: files sss
sudoers_debug: 1
2. sssd.conf:
[domain/ipa.grp]
krb5_realm = IPA.GRP
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = ipa.grp
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = clnt.ipa.grp
chpass_provider = ipa
ipa_dyndns_update = True
ipa_server = _srv_, srv.ipa.grp
ldap_tls_cacert = /etc/ipa/ca.crt
[sssd]
services = nss, pam, ssh, sudo
config_file_version = 2
domains = ipa.grp
[nss]
homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
ldap_sudo_search_base = ou=sudoers,ou=ipa,dc=grp
ldap_sasl_mech = GSSAPI
ldap=sasl_authid = host/cnlt2.ipa.grp
ldap_sasl_realm = IPA.GRP
ldap_netgroup_search_base = ou=SUDOers,dc=ipa,dc=grp
sudo_provider = ldap
ldap_uri = <a class="moz-txt-link-freetext" href="ldap://srv.ipa.grp">ldap://srv.ipa.grp</a>
krb5_server = srv.ipa.grp
</pre>
</blockquote>
<pre wrap="">
These options belong to the [domain] section, you put them into the
[pac] section.
</pre>
<blockquote type="cite">
<pre wrap="">
When I try to use sudo:
user1@clnt:~$ sudo -i user1 vi apt-get update
[sudo] password for user1:
Sorry, user user1 is not allowed to execute '/bin/bash -c user1 vi apt-get
update' as root on clnt.ipa.grp.
user1@clnt:~$
=======================================================
On 28-08-2014 17:21, Jakub Hrozek wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On Thu, Aug 28, 2014 at 02:53:35PM +0300, Tevfik Ceydeliler wrote:
</pre>
<blockquote type="cite">
<pre wrap="">After configuration, for example, I try to create policiy about sudo
command, let's say I want to run "apt-get" command bu sudoas client
How can I use it in client side?
Any example?
</pre>
</blockquote>
<pre wrap="">I still don't understand what you mean, did you check out the 'ipa
sudorule-add-runasuser' command?
</pre>
</blockquote>
<pre wrap="">
--
<br>
<img src=<a class="moz-txt-link-rfc2396E" href="http://www.yasar.com.tr/banner/yhbanner.jpg">"http://www.yasar.com.tr/banner/yhbanner.jpg"</a>> </img>
<br><br>
Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.
</pre>
</blockquote>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<img src="cid:part1.09010604.01000909@astron.yasar.com.tr"
border="0"></div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><br><br>
<img src="http://www.yasar.com.tr/banner/yhbanner.jpg"> </img><br>
<br><br><br>
Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.<br>
</font></td></tr></table>