<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I still can’t find the problem after a lot of searching, can someone give me a little advice? Assembling a POC of FreeIPA 4.1.0 server (stock CentOS-7 packages) and a CentOS 6.7 server with their stock 3.0.0 packages. Sudo version on
the client is sudo-1.8.6p3. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Have created a general sudo rule on the IPA server to grant access to a host group. However it doesn’t allow access, just a “sparksa is not allowed to run sudo on als-centos0002”. If I change the rule to not use host groups, and explicitly
set the hosts, it works OK.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Have checked the stuff I’ve seen in general search, like the nisdomainname, values are set and look plausible. The sudo debug logs seem to indicate vaguely that it can’t match the netgroup:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Nov 18 16:07:37 sudo[15713] username=sparksa<o:p></o:p></p>
<p class="MsoNormal">Nov 18 16:07:37 sudo[15713] domainname=(null)<o:p></o:p></p>
<p class="MsoNormal">Nov 18 16:07:37 sudo[15713] Received 1 rule(s)<o:p></o:p></p>
<p class="MsoNormal">Nov 18 16:07:37 sudo[15713] sssd/ldap sudoHost '+opsauto' ... not<o:p></o:p></p>
<p class="MsoNormal">Nov 18 16:07:37 sudo[15713] Sorting the remaining entries using the sudoOrder attribute<o:p></o:p></p>
<p class="MsoNormal">Nov 18 16:07:37 sudo[15713] searching SSSD/LDAP for sudoers entries<o:p></o:p></p>
<p class="MsoNormal">Nov 18 16:07:37 sudo[15713] Done with LDAP searches<o:p></o:p></p>
<p class="MsoNormal">Nov 18 16:07:37 sudo[15713] keep HOSTNAME=als-centos0002.dakar.useast.hpcloud.net: YES<o:p></o:p></p>
<p class="MsoNormal">Nov 18 16:07:37 sudo[15713] sudo_putenv: HOSTNAME=als-centos0002.dakar.useast.hpcloud.net<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The setup of the client used the normal ‘ipa-client-install’ script. From questions asked before, some salient debugging info:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[root@als-centos0002 sys-ops]# nisdomainname<o:p></o:p></p>
<p class="MsoNormal">dakar.useast.hpcloud.net<o:p></o:p></p>
<p class="MsoNormal">[root@als-centos0002 sys-ops]# hostname<o:p></o:p></p>
<p class="MsoNormal">als-centos0002.dakar.useast.hpcloud.net<o:p></o:p></p>
<p class="MsoNormal">[root@als-centos0002 sys-ops]# getent netgroup opsauto<o:p></o:p></p>
<p class="MsoNormal">opsauto (als-ubuntu0001.oa.ftc.hpelabs.net,-,eucalyptus.internal) (als-centos0002.dakar.useast.hpcloud.net,-,eucalyptus.internal)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Does anyone have any advice on what additional debug I should look at, just not sure what I’m missing. Thanks in advance.<o:p></o:p></p>
<p class="MsoNormal">-Alan<o:p></o:p></p>
</div>
</body>
</html>