On Tue, Sep 09, 2008 at 10:42:06PM +0100, Kashif Ali wrote:
i believe in centos 5.x and redhat they have ldap suppor built in:
http://kbase.redhat.com/faq/FAQ_80_12975.shtm
I am not sure how to include ldif file in the directory server, and also
once its included how to manage the sudoers?
let me give you some more background on the environmnt:
we have the following environments:
Production
Staging
Test
Load Testing
Development
Each of the environments have various number of servers ranging from 30 and
goign upto 150+.
we have three main categories of users
Linuxops = Linux Sys admins
SuperUsers = Developers who have sudo rights (ALL) on dev/load test
environments, but only for less, cat, more, command for
Test/Staging/Production environments (this is mainly for log and config file
viewing).
Dev = Developers who have full sudo rights on development and only access
development environment
I am restricting access to each environemnt via SSHD_CONFIG variable allow
groups. I have the following groups
linuxops
prodlogs
staginglog
testlogs
ltlogs
dev
What I would need is to someone configure ldap with sudo, so that if you
were in the correct groups you can login to which ever environment and have
the correct privilages.
The problem I Will have is with superusers. They would be members of the dev
group (so have all rights on dev env) but then I would be added to prodlogs
etc... so they have restricted sudo on prod. However since there would only
be one sudo file in ldap, sshd would let them logon to production server via
prodlogs group, and sudo would find the dev group and give them full
rights!!!!
sudo has the Host_Alias feature to restrict command aliases to
particular hosts, which I think would achieve your aims.
See the EXAMPLES section of the sudoers(5) man page.
There's a sudoers2ldif utility provided with the sudo distribution, it's
well worth developing your sudoer's file with visudo for its syntax
checking before converting to ldif with the sudoers2ldif utility.
--
Jonathan Barber
High Performance Computing Analyst
Tel. +44 (0) 1382 386389