Hi Simon
On the server:
[root@testldap01 ~]# rpm -qa 389*
389-ds-base-1.4.4.17-1.module_el8+13163+e27841f7.x86_64
389-ds-base-libs-1.4.4.17-1.module_el8+13163+e27841f7.x86_64
On the client:
[root@testldapclient01 log]# rpm -qa *ldap*
openldap-clients-2.4.44-24.el7_9.x86_64
openldap-devel-2.4.44-24.el7_9.x86_64
python-ldap-2.4.15-2.el7.x86_64
openldap-2.4.44-24.el7_9.x86_64
nss-pam-ldapd-0.8.13-25.el7.x86_64
sssd-ldap-1.16.4-37.el7_8.3.x86_64
The sudo logs say according to A.2. Troubleshooting sudo with SSSD and sudo Debugging Logs
Red Hat Enterprise Linux 7 | Red Hat Customer
Portal<https://access.redhat.com/documentation/en-us/red_hat_enterpris...;:
[root@testldapclient01 log]# grep testldapclient01 sudo_debug.log
Mar 23 09:56:53 sudo[22331] <- sudo_new_key_val_v1 @ ./key_val.c:56 :=
host=testldapclient01.as.mydomain.ch
Mar 23 09:56:53 sudo[22331] user_info: host=testldapclient01.as.mydomain.ch
Mar 23 09:56:53 sudo[22331] keep HOSTNAME=testldapclient01.as.mydomain.ch: YES
Mar 23 09:56:53 sudo[22331] sudo_putenv: HOSTNAME=testldapclient01.as.mydomain.ch
Mar 23 09:56:53 sudo[22331] netgroup ABX_server_test matches
(testldapclient01.as.mydomain.ch|testldapclient01, , as.mydomain.ch): false @
netgr_matches() ./match.c:1228
Mar 23 09:56:53 sudo[22331] host testldapclient01 matches sudoers pattern
+ABX_server_test: false @ hostname_matches() ./match.c:997
The client can resolve the referenced netgroup:
[root@testldapclient01 log]# getent netgroup ABX_server_test
ABX_server_test (testldapclient01,-,-) (testldapclient01.as.mydomain.ch,-,-)
As I interpret the logs:
1. The client sees, that the hostname it is installed on is
testldapclient01.as.mydomain.ch. (sudo_putenv: HOSTNAME=testldapclient01.as.mydomain.ch)
2. The client sees the referenced netgroup ABX_server_test with the server
testldapclient01.as.mydomain.ch within.
3. The client compares the system hostname with the hostname in the netgroup and finds
no match.
To exclude typos, I copied the return of the hostname command in the referenced netgroup
of my Apache Studio. I do not understand, why there is no match, as the hostnames are
identical.
If I set the hostname directly in the Apache Studio SUDOers group with the attribute
sudoHost, it works. If I set +ABX_server_test, it fails.
Further logs
· Messages: Mar 23 09:56:38 testldapclient01 sssd[be[LDAP]]: Starting up
Mar 23 09:56:38 testldapclient01 sssd[be[LDAP]]: Your configuration uses the autofs
provider with schema set to rfc2307 and default attribute mappings. The default map has
changed in this release, please make sure the configuration matches the server
attributes.
The other logfiles contain no information regarding the hostname.
I could solve the same issue with the sudoUser attribute, by renaming the netgroup.
Renaming the netgroup for the sudoHost did not help.
My netgroup entry is
[cid:image003.png@01D84023.2A99B8A0]
Thanks a lot. If you need any more information or logs, please let me know.
Sincerely,
Tibor