141 lines
3.5 KiB
Markdown
141 lines
3.5 KiB
Markdown
# LDAP: Sudo
|
||
|
||
Prerequisites:
|
||
|
||
- 389 DS server
|
||
- LDAP Directory Manager (or equivalent) permissions
|
||
- SSSD client
|
||
- Client root (or equivalent) permissions - ideally not only \`sudo\`
|
||
permissions, in case you lock yourself out of \`sudo\`
|
||
|
||
### Verify the sudo schema is installed:
|
||
|
||
<div class="code panel pdl" style="border-width: 1px;">
|
||
|
||
<div class="codeContent panelContent pdl">
|
||
|
||
``` bash
|
||
# file (locate 60sudo.ldif)
|
||
/usr/share/dirsrv/schema/60sudo.ldif: ASCII text
|
||
```
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
### Create OU:
|
||
|
||
Create an organizational unit to house SUDOers settings using a GUI or
|
||
using ldapadd/ldapmodify. This is not documented here, but the LDIF
|
||
query should look something like this:
|
||
|
||
<div class="code panel pdl" style="border-width: 1px;">
|
||
|
||
<div class="codeContent panelContent pdl">
|
||
|
||
``` java
|
||
dn: ou=SUDOers,ou=syscid-system,dc=syscid,dc=com
|
||
changetype: add
|
||
ou: SUDOers
|
||
objectClass: organizationalUnit
|
||
objectClass: top
|
||
```
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
### Convert existing, local, sudoers to LDIF:
|
||
|
||
Convert an existing, local, sudoers file to an LDAP importable LDIF. Old
|
||
articles suggest the Perl script used for this should be included in the
|
||
\`sudo\` package, however that does not seem to be the case on the SUSE
|
||
systems I worked with - I dug the script out of deep parts of the
|
||
internet and attached it here - whether it is "original" I cannot tell.
|
||
|
||
Note that the SUDOERS_BASE environment variable needs to be filled with
|
||
the DN of the OU created above.
|
||
|
||
<div class="code panel pdl" style="border-width: 1px;">
|
||
|
||
<div class="codeContent panelContent pdl">
|
||
|
||
``` bash
|
||
# export SUDOERS_BASE=ou=SUDOers,ou=syscid-system,dc=syscid,dc=com
|
||
# echo $SUDOERS_BASE
|
||
ou=SUDOers,ou=syscid-system,dc=syscid,dc=com
|
||
# perl sudoers2ldif.pl /etc/sudoers | tee sudoers-389.ldif
|
||
# file sudoers-389.ldif
|
||
sudoers-389.ldif: ASCII text
|
||
```
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
#### Inspect the file for faulty lines:
|
||
|
||
In the `sudoers-389.ldif` file generated above, look for failed lines,
|
||
which may look similar to the following:
|
||
|
||
`parse error: Defaults!/usr/bin/sudoreplay !log_output`
|
||
|
||
`parse error: Defaults!REBOOT !log_output`
|
||
|
||
Remove them, in order to have a valid LDIF.
|
||
|
||
If the lines seem crucial to you, either correct the input sudoers file,
|
||
and run the script again, or try to manually add the settings in your OU
|
||
after the import.
|
||
|
||
### Import the LDIF:
|
||
|
||
<div class="code panel pdl" style="border-width: 1px;">
|
||
|
||
<div class="codeContent panelContent pdl">
|
||
|
||
``` bash
|
||
# ldapadd -xWD 'cn=Directory Manager' -f sudoers-389.ldif
|
||
```
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
### Verify the result:
|
||
|
||
<img src="attachments/5341350/5341353.png" height="150" /><img src="attachments/5341350/5341352.png" height="150" />
|
||
|
||
### Configure a client:
|
||
|
||
Add to / modify in `/etc/nsswitch.conf`:
|
||
|
||
sudoers: sss
|
||
|
||
Add to / modify in /etc/sssd/sssd.conf:
|
||
|
||
sudo_provider = ldap ldap_sudo_search_base =
|
||
ou=SUDOers,ou=syscid-system,dc=syscid,dc=com
|
||
|
||
I read that a \`service\` entry should no longer be necessary, but am
|
||
adding it to my existing services for good measure:
|
||
|
||
services = nss, pam, ssh, sudo
|
||
|
||
<div class="pageSectionHeader">
|
||
|
||
## Attachments:
|
||
|
||
</div>
|
||
|
||
<div class="greybox" align="left">
|
||
|
||
<img src="images/icons/bullet_blue.gif" width="8" height="8" />
|
||
[SUDOers_Defaults.png](attachments/5341350/5341352.png) (image/png)
|
||
<img src="images/icons/bullet_blue.gif" width="8" height="8" />
|
||
[SUDOers_OU.png](attachments/5341350/5341353.png) (image/png)
|
||
<img src="images/icons/bullet_blue.gif" width="8" height="8" />
|
||
[sudoers2ldif.pl](attachments/5341350/5341355.pl) (application/x-perl)
|
||
|
||
</div>
|