we're using sssd for Kerberos logins with LDAP user account details, and
it's caching sudo LDAP for us too. I'm not sure off hand if it'll work with
nested groups if you use them - we haven't used nested groups on any of the
groups we've used with sudo (due to other various programs failing to
support either recursing through groups or using the memberof attribute on
the user).
For that example I gave before, the other sudo values are:
sudocommand: ALL
sudohost: ALL
On other sudoroles we have specific commands and hosts too. We're not using
any other sudo attributes on our sudoroles at the moment (we actually need
to update the schema for the version of sudo we're running, since it
expectes sudorunasuser and sudorunasgroup rather than sudorunas, for
example).
On Wed, May 22, 2013 at 7:54 PM, Dan Lavu <dan(a)lavu.net> wrote:
John,
Thats the last thing I wanted to hear. What attributes do you have,
sudouser, sudooptions, sudorun? Also are you using sssd or pam ldap?
Dan
On May 22, 2013, at 7:52 PM, Jonathan Vaughn <jonathan(a)creatuity.com>
wrote:
Works for us fine without any fancy treatment:
sudouser: %Global System Administrators
using sudo 1.8.something on centos.
On Wed, May 22, 2013 at 7:36 PM, Dan Lavu <dan(a)lavu.net> wrote:
> Has anybody successfully created a sudoers group in 389 that contains a
> space? Whatever way I try to escape the space in my sudouser attribute it
> just doesn't like it. I'm able to escape the space in /etc/sudoers by using
> \ .
>
> So..
>
> sudouser: %domain\ admins
> sudouser: %domain admins
> sudouser: \%domain\ admins
> sudouser: "%domain admins"
> sudouser: '%domain admins'
>
> have not worked, thanks in advance.
>
> Dan
> --
> 389 users mailing list
> 389-users(a)lists.fedoraproject.org
>
https://admin.fedoraproject.org/mailman/listinfo/389-users
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users