<div>
<div>Full log attached.</div>
<div> </div>
<div>"Molnár Domokos" <kretebe@freemail.hu> írta:
<blockquote style="border-left:3px solid lightGray;padding-left:3px;">
<div>
<div><br />
"Pavel Březina" <pbrezina@redhat.com> írta:
<blockquote style="border-left:3px solid lightGray;padding-left:3px;">On 09/09/2015 09:31 PM, Molnár Domokos wrote:<br />
> I have a working IPA server and a working client config on an OpenSuse<br />
> 13.2 with the following versions:<br />
> nappali:~ # rpm -qa |grep sssd<br />
> sssd-tools-1.12.2-3.4.1.i586<br />
> sssd-krb5-1.12.2-3.4.1.i586<br />
> python-sssd-config-1.12.2-3.4.1.i586<br />
> sssd-ipa-1.12.2-3.4.1.i586<br />
> sssd-1.12.2-3.4.1.i586<br />
> sssd-dbus-1.12.2-3.4.1.i586<br />
> sssd-krb5-common-1.12.2-3.4.1.i586<br />
> sssd-ldap-1.12.2-3.4.1.i586<br />
> sssd is confihured for nss, pam, sudo<br />
> There is a test sudo rule defined in the ipa server, which applies to<br />
> user "doma". However when the user tries to use sudo the rule does not<br />
> work.<br />
> doma@nappali:/home/doma> sudo ls<br />
> doma's password:<br />
> doma is not allowed to run sudo on nappali. This incident will be reported.<br />
> The corresponding log in the sssd_sudo.log is this:<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_cmd_get_version] (0x0200):<br />
> Received client version [1].<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_cmd_get_version] (0x0200):<br />
> Offered version [1].<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_parse_name_for_domains]<br />
> (0x0200): name 'doma' matched without domain, user is doma<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_parse_name_for_domains]<br />
> (0x0200): name 'doma' matched without domain, user is doma<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_cmd_parse_query_done]<br />
> (0x0200): Requesting default options for [doma] from [<ALL>]<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_get_user] (0x0200):<br />
> Requesting info about [doma@szilva]<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]]<br />
> [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with<br />
> [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=doma)(sudoUser=#1816400003)(sudoUser=%ipausers)(sudoUser=%picture_access)(sudoUser=%doma)(sudoUser=+*))(&(dataExpireTimestamp<=1441826725)))]<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]]<br />
> [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with<br />
> [(&(objectClass=sudoRule)(|(name=defaults)))]<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_parse_name_for_domains]<br />
> (0x0200): name 'doma' matched without domain, user is doma<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_parse_name_for_domains]<br />
> (0x0200): name 'doma' matched without domain, user is doma<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_cmd_parse_query_done]<br />
> (0x0200): Requesting rules for [doma] from [<ALL>]<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_get_user] (0x0200):<br />
> Requesting info about [doma@szilva]<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]]<br />
> [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with<br />
> [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=doma)(sudoUser=#1816400003)(sudoUser=%ipausers)(sudoUser=%picture_access)(sudoUser=%doma)(sudoUser=+*))(&(dataExpireTimestamp<=1441826725)))]<br />
> (Wed Sep 9 21:25:25 2015) [sssd[sudo]]<br />
> [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with<br />
> [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=doma)(sudoUser=#1816400003)(sudoUser=%ipausers)(sudoUser=%picture_access)(sudoUser=%doma)(sudoUser=+*)))]<br />
> (Wed Sep 9 21:25:30 2015) [sssd[sudo]] [client_recv] (0x0200): Client<br />
> disconnected!<br />
> This seems perfectly OK with one exception. The query against the sysdb<br />
> does not find the entry. This is strange because the entry is there.<br />
> Log in sssd.log:<br />
> (Wed Sep 2 08:52:13 2015) [sssd] [sysdb_domain_init_internal] (0x0200):<br />
> DB File for szilva: /var/lib/sss/db/cache_szilva.ldb<br />
> So we know that the sysdb is /var/lib/sss/db/cache_szilva.ldb<br />
> Running the exact same query seen above in the sssd_sudo.log against the<br />
> db returns:<br />
> ldbsearch -H /var/lib/sss/db/cache_szilva.ldb<br />
> "(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=doma)(sudoUser=#1816400003)(sudoUser=%ipausers)(sudoUser=%picture_access)(sudoUser=%doma)(sudoUser=+*)))"<br />
> asq: Unable to register control with rootdse!<br />
> # record 1<br />
> dn: name=Doma_ls,cn=sudorules,cn=custom,cn=szilva,cn=sysdb<br />
> cn: Doma_ls<br />
> dataExpireTimestamp: 1441830262<br />
> entryUSN: 20521<br />
> name: Doma_ls<br />
> objectClass: sudoRule<br />
> originalDN: cn=Doma_ls,ou=sudoers,dc=szilva<br />
> sudoCommand: ls<br />
> sudoHost: nappali.szilva<br />
> sudoRunAsGroup: ALL<br />
> sudoRunAsUser: ALL<br />
> sudoUser: doma<br />
> distinguishedName: name=Doma_ls,cn=sudorules,cn=custom,cn=szilva,cn=sysdb<br />
> # returned 1 records<br />
> # 1 entries<br />
> # 0 referrals<br />
> This confirms that the entry is indeed there in the db. Why is it found<br />
> with ldbsearch and why does sssd_sudo not find it?<br />
> I am pretty much stuck with this one. Anyone has an idea?<br />
><br />
><br />
Hi,<br />
this is strange. Can you provide the logs with debug level set to 0x3ff0 <br />
please? Can you also send it as an attachment? Thanks!</blockquote>
<div>Sure. Here it is. Now I can see that the rule is returned. The question is why the rule does not match. Anyway much better :)</div>
<div> </div>
<div>
<div>(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requesting info about [doma@szilva]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_user] (0x0400): Returning info for user [doma@szilva]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_rules] (0x0400): Retrieving default options for [doma] from [szilva]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=doma)(sudoUser=#1816400003)(sudoUser=%ipausers)(sudoUser=%picture_access)(sudoUser=%doma)(sudoUser=+*))(&(dataExpireTimestamp<=1441973997)))]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_rules] (0x2000): About to get sudo rules from cache<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(name=defaults)))]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_sudorules_from_cache] (0x0400): Returning 0 rules for [<default options>@szilva]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_cmd] (0x2000): Using protocol version [1]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'doma' matched without domain, user is doma<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'doma' matched without domain, user is doma<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_cmd_parse_query_done] (0x0200): Requesting rules for [doma] from [<ALL>]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requesting info about [doma@szilva]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_user] (0x0400): Returning info for user [doma@szilva]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_rules] (0x0400): Retrieving rules for [doma] from [szilva]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=doma)(sudoUser=#1816400003)(sudoUser=%ipausers)(sudoUser=%picture_access)(sudoUser=%doma)(sudoUser=+*))(&(dataExpireTimestamp<=1441973997)))]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_rules] (0x2000): About to get sudo rules from cache<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=doma)(sudoUser=#1816400003)(sudoUser=%ipausers)(sudoUser=%picture_access)(sudoUser=%doma)(sudoUser=+*)))]<br />
(Fri Sep 11 14:19:57 2015) [sssd[sudo]] [sudosrv_get_sudorules_from_cache] (0x0400): Returning 1 rules for [doma@szilva]<br />
(Fri Sep 11 14:20:00 2015) [sssd[sudo]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit<br />
(Fri Sep 11 14:20:00 2015) [sssd[sudo]] [client_recv] (0x0200): Client disconnected!<br />
(Fri Sep 11 14:20:00 2015) [sssd[sudo]] [client_destructor] (0x2000): Terminated client [0x8f6abd0][17]<br />
(Fri Sep 11 14:20:10 2015) [sssd[sudo]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit</div>
<div> </div>
<div>as doma:</div>
</div>
<div>
<div> </div>
<div>doma@nappali:/home/doma> id<br />
uid=1816400003(doma) gid=1816400003(doma) groups=1816400003(doma),16(dialout),33(video),112(vboxusers),1000(burning),1816400006(picture_access)<br />
doma@nappali:/home/doma> hostname --fqdn<br />
nappali.szilva<br />
doma@nappali:/home/doma> domainname<br />
szilva<br />
doma@nappali:/home/doma> nisdomainname<br />
szilva<br />
doma@nappali:/home/doma> dnsdomainname<br />
szilva<br />
doma@nappali:/home/doma> sudo ls<br />
doma's password:<br />
doma is not allowed to run sudo on nappali. This incident will be reported.<br />
doma@nappali:/home/doma></div>
<div> </div>
<div>as root:</div>
<div> </div>
<div>nappali:~ # ntpq -p<br />
remote refid st t when poll reach delay offset jitter<br />
==============================================================================<br />
*helios.szilva 193.6.222.47 3 u 56 64 377 0.779 1.365 0.420<br />
LOCAL(0) .LOCL. 10 l 535 64 0 0.000 0.000 0.000<br />
nappali:~ #</div>
<div> </div>
<div>helios.szilva is the standalone IPA server.</div>
<div> </div>
</div>
</div>
</div>
</blockquote>
</div>
</div>