On pe, 12 marras 2021, Rikimaru Honjo via FreeIPA-users wrote:
Hi All,
Can I allow sudo to users on only specified hosts by FreeIPA?
Yes. The key to this is to understand that accessing sudo is actually a
two-step check:
- first, sudo itself uses PAM to validate whether a user is able to run
sudo
- second, if PAM access is allowed, sudo evaluates own rules
Default PAM configuration for sudo includes system-provided PAM defaults
(system-auth in case of Fedora or RHEL):
# cat /etc/pam.d/sudo
#%PAM-1.0
auth include system-auth
account include system-auth
password include system-auth
session optional pam_keyinit.so revoke
session required pam_limits.so
session include system-auth
# cat /etc/pam.d/sudo-i
#%PAM-1.0
auth include sudo
account include sudo
password include sudo
session optional pam_keyinit.so force revoke
session include sudo
system-auth includes pam_sss.so. You can create HBAC rules to grant
access to 'sudo' HBAC service. This way pam_sss.so on your client will
do the first check.
Then you can additionally tie sudo rules to specific hosts for specific
users.
I know that users can use sudo on all nodes if I create
"sudo" group and
add users to the group by FreeIPA. But I don't wish it.
You shouldn't. Use HBAC rules to define access through PAM.
In my understand, sudo rule's porpose is different from the above
one.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland