Hi Alexander,
Thank you for your explanation! I could understand that I can use HBAC rules for my
purpose.
I have one more question. Is there any knowledge about PAM configuration of Debian/Ubuntu
for this?
Best regards,
On 2021/11/12 17:02, Alexander Bokovoy wrote:
On pe, 12 marras 2021, Rikimaru Honjo via FreeIPA-users wrote:
> Hi All,
>
> Can I allow sudo to users on only specified hosts by FreeIPA?
Yes. The key to this is to understand that accessing sudo is actually a
two-step check:
- first, sudo itself uses PAM to validate whether a user is able to run
sudo
- second, if PAM access is allowed, sudo evaluates own rules
Default PAM configuration for sudo includes system-provided PAM defaults
(system-auth in case of Fedora or RHEL):
# cat /etc/pam.d/sudo
#%PAM-1.0
auth include system-auth
account include system-auth
password include system-auth
session optional pam_keyinit.so revoke
session required pam_limits.so
session include system-auth
# cat /etc/pam.d/sudo-i
#%PAM-1.0
auth include sudo
account include sudo
password include sudo
session optional pam_keyinit.so force revoke
session include sudo
system-auth includes pam_sss.so. You can create HBAC rules to grant
access to 'sudo' HBAC service. This way pam_sss.so on your client will
do the first check.
Then you can additionally tie sudo rules to specific hosts for specific
users.
> I know that users can use sudo on all nodes if I create "sudo" group and
> add users to the group by FreeIPA. But I don't wish it.
You shouldn't. Use HBAC rules to define access through PAM.
> In my understand, sudo rule's porpose is different from the above one.