Hello, i'm having some trouble getting sudoers to work. I have 5 machines joined to the FreeIPA domain and I have a user group called ops and ops_sudoers. Both have permission to full sudo.
[andrew.meyer@jira02 ~]$ ipa sudorule-find ALL-------------------1 Sudo Rule matched------------------- Rule name: All Enabled: TRUE Host category: all Command category: all Sudo Option: !authenticate----------------------------Number of entries returned 1---------------------------- [andrew.meyer@jira02 ~]$ ipa sudorule-show ALL Rule name: All Enabled: TRUE Host category: all Command category: all Users: brian.keithly, andrew.meyer User Groups: ops_sudoers, ops RunAs Users: process Sudo Option: !authenticate [andrew.meyer@jira02 ~]$ sudo su -[sudo] password for andrew.meyer:Sorry, user andrew.meyer is not allowed to execute '/bin/su -' as root on jira02.mgt.example.net.[andrew.meyer@jira02 ~]$ My HBAC is set to allow_all. [root@jira02 log]# cat /etc/sssd/sssd.conf[domain/mgt.example.net] cache_credentials = Truekrb5_store_password_if_offline = Truekrb5_realm = EXAMPLE.NETipa_domain = mgt.example.netid_provider = ipaauth_provider = ipaaccess_provider = ipaipa_hostname = jira02.mgt.example.netchpass_provider = ipadyndns_update = Trueipa_server = _srv_, infra-test-ipa.example.netdyndns_iface = ens160ldap_tls_cacert = /etc/ipa/ca.crt[sssd]services = nss, pam, ssh, sudo domains = mgt.example.net[nss]homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [secrets] [root@jira02 log]#
Andrew Meyer via FreeIPA-users wrote:
Hello, i'm having some trouble getting sudoers to work.
I have 5 machines joined to the FreeIPA domain and I have a user group called ops and ops_sudoers. Both have permission to full sudo.
[andrew.meyer@jira02 ~]$ ipa sudorule-find ALL
1 Sudo Rule matched
Rule name: All Enabled: TRUE Host category: all Command category: all Sudo Option: !authenticate
Number of entries returned 1
[andrew.meyer@jira02 ~]$ ipa sudorule-show ALL Rule name: All Enabled: TRUE Host category: all Command category: all Users: brian.keithly, andrew.meyer User Groups: ops_sudoers, ops RunAs Users: process Sudo Option: !authenticate
[andrew.meyer@jira02 ~]$ sudo su - [sudo] password for andrew.meyer: Sorry, user andrew.meyer is not allowed to execute '/bin/su -' as root on jira02.mgt.example.net. [andrew.meyer@jira02 ~]$
My HBAC is set to allow_all.
[root@jira02 log]# cat /etc/sssd/sssd.conf [domain/mgt.example.net]
cache_credentials = True krb5_store_password_if_offline = True krb5_realm = EXAMPLE.NET ipa_domain = mgt.example.net id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = jira02.mgt.example.net chpass_provider = ipa dyndns_update = True ipa_server = _srv_, infra-test-ipa.example.net dyndns_iface = ens160 ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, pam, ssh, sudo
domains = mgt.example.net [nss] homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
[secrets]
[root@jira02 log]#
Start here: https://docs.pagure.org/SSSD.sssd/users/sudo_troubleshooting.html
rob
so looking at the logs it find a rule: (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_cached_rules_by_user] (0x0400): Replacing sudoUser attribute with sudoUser: #1154600003(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(sudoUser=+*)(!(|(sudoUser=ALL)(sudoUser=andrew.meyer@mgt.stl.gatewayblend.net)(sudoUser=#1154600003)(sudoUser=%answers\20jira\20engineers@mgt.stl.example.net)(sudoUser=%answers\20jira\20admins@mgt.stl.example.net)(sudoUser=%example-admins@mgt.stl.example.net)(sudoUser=%answers\20jira\20users@mgt.stl.example.net)(sudoUser=%ipausers@mgt.stl.example.net)(sudoUser=%admins@mgt.stl.example.net)(sudoUser=%wheel@mgt.stl.example.net)(sudoUser=%ops_sudoers@mgt.stl.example.net)(sudoUser=%ops@mgt.stl.example.net)(sudoUser=%admins@mgt.stl.example.net))))](Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sort_sudo_rules] (0x0400): Sorting rules with higher-wins logic(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 1 rules for [andrew.meyer@mgt.stl.example.net@mgt.stl.example.net](Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): error: [0](Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rules_num: [0](Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rule [1]/[1](Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): cn:All(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): objectClass:sudoRule(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoCommand:ALL(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoHost:ALL(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoOption:!authenticate(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoRunAsUser:process(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoUser:#1154600003(Wed Nov 8 14:23:40 2017) [sssd[sudo]] [client_recv] (0x0200): Client disconnected!(Wed Nov 8 14:23:40 2017) [sssd[sudo]] [client_close_fn] (0x2000): Terminated client [0x55fce3abe990][18] the sssd_hostname log is complaining about no SELinux maps...
On Wednesday, November 8, 2017 1:43 PM, Rob Crittenden via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Andrew Meyer via FreeIPA-users wrote:
Hello, i'm having some trouble getting sudoers to work.
I have 5 machines joined to the FreeIPA domain and I have a user group called ops and ops_sudoers. Both have permission to full sudo.
[andrew.meyer@jira02 ~]$ ipa sudorule-find ALL
1 Sudo Rule matched
Rule name: All Enabled: TRUE Host category: all Command category: all Sudo Option: !authenticate
Number of entries returned 1
[andrew.meyer@jira02 ~]$ ipa sudorule-show ALL Rule name: All Enabled: TRUE Host category: all Command category: all Users: brian.keithly, andrew.meyer User Groups: ops_sudoers, ops RunAs Users: process Sudo Option: !authenticate
[andrew.meyer@jira02 ~]$ sudo su - [sudo] password for andrew.meyer: Sorry, user andrew.meyer is not allowed to execute '/bin/su -' as root on jira02.mgt.example.net. [andrew.meyer@jira02 ~]$
My HBAC is set to allow_all.
[root@jira02 log]# cat /etc/sssd/sssd.conf [domain/mgt.example.net]
cache_credentials = True krb5_store_password_if_offline = True krb5_realm = EXAMPLE.NET ipa_domain = mgt.example.net id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = jira02.mgt.example.net chpass_provider = ipa dyndns_update = True ipa_server = _srv_, infra-test-ipa.example.net dyndns_iface = ens160 ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, pam, ssh, sudo
domains = mgt.example.net [nss] homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
[secrets]
[root@jira02 log]#
Start here: https://docs.pagure.org/SSSD.sssd/users/sudo_troubleshooting.html
rob _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Nm. I fixed it.
On Wednesday, November 8, 2017 2:28 PM, Andrew Meyer via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
so looking at the logs it find a rule: (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_cached_rules_by_user] (0x0400): Replacing sudoUser attribute with sudoUser: #1154600003(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(sudoUser=+*)(!(|(sudoUser=ALL)(sudoUser=andrew.meyer@mgt.stl.gatewayblend.net)(sudoUser=#1154600003)(sudoUser=%answers\20jira\20engineers@mgt.stl.example.net)(sudoUser=%answers\20jira\20admins@mgt.stl.example.net)(sudoUser=%example-admins@mgt.stl.example.net)(sudoUser=%answers\20jira\20users@mgt.stl.example.net)(sudoUser=%ipausers@mgt.stl.example.net)(sudoUser=%admins@mgt.stl.example.net)(sudoUser=%wheel@mgt.stl.example.net)(sudoUser=%ops_sudoers@mgt.stl.example.net)(sudoUser=%ops@mgt.stl.example.net)(sudoUser=%admins@mgt.stl.example.net))))](Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sort_sudo_rules] (0x0400): Sorting rules with higher-wins logic(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 1 rules for [andrew.meyer@mgt.stl.example.net@mgt.stl.example.net](Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): error: [0](Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rules_num: [0](Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rule [1]/[1](Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): cn:All(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): objectClass:sudoRule(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoCommand:ALL(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoHost:ALL(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoOption:!authenticate(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoRunAsUser:process(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoUser:#1154600003(Wed Nov 8 14:23:40 2017) [sssd[sudo]] [client_recv] (0x0200): Client disconnected!(Wed Nov 8 14:23:40 2017) [sssd[sudo]] [client_close_fn] (0x2000): Terminated client [0x55fce3abe990][18] the sssd_hostname log is complaining about no SELinux maps...
On Wednesday, November 8, 2017 1:43 PM, Rob Crittenden via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Andrew Meyer via FreeIPA-users wrote:
Hello, i'm having some trouble getting sudoers to work.
I have 5 machines joined to the FreeIPA domain and I have a user group called ops and ops_sudoers. Both have permission to full sudo.
[andrew.meyer@jira02 ~]$ ipa sudorule-find ALL
1 Sudo Rule matched
Rule name: All Enabled: TRUE Host category: all Command category: all Sudo Option: !authenticate
Number of entries returned 1
[andrew.meyer@jira02 ~]$ ipa sudorule-show ALL Rule name: All Enabled: TRUE Host category: all Command category: all Users: brian.keithly, andrew.meyer User Groups: ops_sudoers, ops RunAs Users: process Sudo Option: !authenticate
[andrew.meyer@jira02 ~]$ sudo su - [sudo] password for andrew.meyer: Sorry, user andrew.meyer is not allowed to execute '/bin/su -' as root on jira02.mgt.example.net. [andrew.meyer@jira02 ~]$
My HBAC is set to allow_all.
[root@jira02 log]# cat /etc/sssd/sssd.conf [domain/mgt.example.net]
cache_credentials = True krb5_store_password_if_offline = True krb5_realm = EXAMPLE.NET ipa_domain = mgt.example.net id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = jira02.mgt.example.net chpass_provider = ipa dyndns_update = True ipa_server = _srv_, infra-test-ipa.example.net dyndns_iface = ens160 ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, pam, ssh, sudo
domains = mgt.example.net [nss] homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
[secrets]
[root@jira02 log]#
Start here: https://docs.pagure.org/SSSD.sssd/users/sudo_troubleshooting.html
rob _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
What was the resolution?
Patrick Grove, System Administrator, IT Infrastructure NHK International E-mail: patrick.grove@nhkusa.com Office #: 248 308 5624
----- Original Message ----- From: "Andrew Meyer via FreeIPA-users" freeipa-users@lists.fedorahosted.org To: "Andrew Meyer" andrewm659@yahoo.com, "FreeIPA users list" freeipa-users@lists.fedorahosted.org, "FreeIPA users list" freeipa-users@lists.fedorahosted.org Cc: "Rob Crittenden" rcritten@redhat.com, "Andrew Meyer" andrewm659@yahoo.com Sent: Wednesday, November 8, 2017 3:47:42 PM Subject: [Freeipa-users] Re: FreeIPA sudoers
Nm. I fixed it.
On Wednesday, November 8, 2017 2:28 PM, Andrew Meyer via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
so looking at the logs it find a rule:
(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_cached_rules_by_user] (0x0400): Replacing sudoUser attribute with sudoUser: #1154600003 (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(sudoUser=+*)(!(|(sudoUser=ALL)(sudoUser=andrew.meyer@mgt.stl.gatewaybl end.net)(sudoUser=#1154600003)(sudoUser=%answers\20jira\20engineers@mgt.stl.example.net)(sudoUser=%answers\20jira\20admins@mgt.stl.example.net)(sudoUser=%example-admins@mgt.s tl.example.net)(sudoUser=%answers\20jira\20users@mgt.stl.example.net)(sudoUser=%ipausers@mgt.stl.example.net)(sudoUser=%admins@mgt.stl.example.net)(sudoUser=%wheel@mgt.s tl.example.net)(sudoUser=%ops_sudoers@mgt.stl.example.net)(sudoUser=%ops@mgt.stl.example.net)(sudoUser=%admins@mgt.stl.example.net))))] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sort_sudo_rules] (0x0400): Sorting rules with higher-wins logic (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 1 rules for [andrew.meyer@mgt.stl.example.net@mgt.stl.example.net] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): error: [0] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rules_num: [0] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rule [1]/[1] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): cn:All (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): objectClass:sudoRule (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoCommand:ALL (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoHost:ALL (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoOption:!authenticate (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoRunAsUser:process (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoUser:#1154600003 (Wed Nov 8 14:23:40 2017) [sssd[sudo]] [client_recv] (0x0200): Client disconnected! (Wed Nov 8 14:23:40 2017) [sssd[sudo]] [client_close_fn] (0x2000): Terminated client [0x55fce3abe990][18]
the sssd_hostname log is complaining about no SELinux maps...
On Wednesday, November 8, 2017 1:43 PM, Rob Crittenden via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Andrew Meyer via FreeIPA-users wrote:
Hello, i'm having some trouble getting sudoers to work.
I have 5 machines joined to the FreeIPA domain and I have a user group called ops and ops_sudoers. Both have permission to full sudo.
[ andrew.meyer@jira02 ~]$ ipa sudorule-find ALL
1 Sudo Rule matched
Rule name: All Enabled: TRUE Host category: all Command category: all Sudo Option: !authenticate
Number of entries returned 1
[ andrew.meyer@jira02 ~]$ ipa sudorule-show ALL Rule name: All Enabled: TRUE Host category: all Command category: all Users: brian.keithly, andrew.meyer User Groups: ops_sudoers, ops RunAs Users: process Sudo Option: !authenticate
[ andrew.meyer@jira02 ~]$ sudo su - [sudo] password for andrew.meyer: Sorry, user andrew.meyer is not allowed to execute '/bin/su -' as root on jira02.mgt.example.net. [ andrew.meyer@jira02 ~]$
My HBAC is set to allow_all.
[ root@jira02 log]# cat /etc/sssd/sssd.conf [domain/mgt.example.net]
cache_credentials = True krb5_store_password_if_offline = True krb5_realm = EXAMPLE.NET ipa_domain = mgt.example.net id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = jira02.mgt.example.net chpass_provider = ipa dyndns_update = True ipa_server = _srv_, infra-test-ipa.example.net dyndns_iface = ens160 ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, pam, ssh, sudo
domains = mgt.example.net [nss] homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
[secrets]
[ root@jira02 log]#
Start here: https://docs.pagure.org/SSSD.sssd/users/sudo_troubleshooting.html
rob
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
I tried to add to much to the rule. I added a RunAs or AuthAs option which killed me.
On Wednesday, November 8, 2017 2:51 PM, Patrick Grove via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
What was the resolution?
Patrick Grove, System Administrator, IT Infrastructure NHK International E-mail: patrick.grove@nhkusa.com Office #: 248 308 5624
----- Original Message ----- From: "Andrew Meyer via FreeIPA-users" freeipa-users@lists.fedorahosted.org To: "Andrew Meyer" andrewm659@yahoo.com, "FreeIPA users list" freeipa-users@lists.fedorahosted.org, "FreeIPA users list" freeipa-users@lists.fedorahosted.org Cc: "Rob Crittenden" rcritten@redhat.com, "Andrew Meyer" andrewm659@yahoo.com Sent: Wednesday, November 8, 2017 3:47:42 PM Subject: [Freeipa-users] Re: FreeIPA sudoers
Nm. I fixed it.
On Wednesday, November 8, 2017 2:28 PM, Andrew Meyer via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
so looking at the logs it find a rule:
(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_cached_rules_by_user] (0x0400): Replacing sudoUser attribute with sudoUser: #1154600003 (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(sudoUser=+*)(!(|(sudoUser=ALL)(sudoUser=andrew.meyer@mgt.stl.gatewaybl end.net)(sudoUser=#1154600003)(sudoUser=%answers\20jira\20engineers@mgt.stl.example.net)(sudoUser=%answers\20jira\20admins@mgt.stl.example.net)(sudoUser=%example-admins@mgt.s tl.example.net)(sudoUser=%answers\20jira\20users@mgt.stl.example.net)(sudoUser=%ipausers@mgt.stl.example.net)(sudoUser=%admins@mgt.stl.example.net)(sudoUser=%wheel@mgt.s tl.example.net)(sudoUser=%ops_sudoers@mgt.stl.example.net)(sudoUser=%ops@mgt.stl.example.net)(sudoUser=%admins@mgt.stl.example.net))))] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sort_sudo_rules] (0x0400): Sorting rules with higher-wins logic (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 1 rules for [andrew.meyer@mgt.stl.example.net@mgt.stl.example.net] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): error: [0] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rules_num: [0] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rule [1]/[1] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): cn:All (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): objectClass:sudoRule (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoCommand:ALL (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoHost:ALL (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoOption:!authenticate (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoRunAsUser:process (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoUser:#1154600003 (Wed Nov 8 14:23:40 2017) [sssd[sudo]] [client_recv] (0x0200): Client disconnected! (Wed Nov 8 14:23:40 2017) [sssd[sudo]] [client_close_fn] (0x2000): Terminated client [0x55fce3abe990][18]
the sssd_hostname log is complaining about no SELinux maps...
On Wednesday, November 8, 2017 1:43 PM, Rob Crittenden via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Andrew Meyer via FreeIPA-users wrote:
Hello, i'm having some trouble getting sudoers to work.
I have 5 machines joined to the FreeIPA domain and I have a user group called ops and ops_sudoers. Both have permission to full sudo.
[ andrew.meyer@jira02 ~]$ ipa sudorule-find ALL
1 Sudo Rule matched
Rule name: All Enabled: TRUE Host category: all Command category: all Sudo Option: !authenticate
Number of entries returned 1
[ andrew.meyer@jira02 ~]$ ipa sudorule-show ALL Rule name: All Enabled: TRUE Host category: all Command category: all Users: brian.keithly, andrew.meyer User Groups: ops_sudoers, ops RunAs Users: process Sudo Option: !authenticate
[ andrew.meyer@jira02 ~]$ sudo su - [sudo] password for andrew.meyer: Sorry, user andrew.meyer is not allowed to execute '/bin/su -' as root on jira02.mgt.example.net. [ andrew.meyer@jira02 ~]$
My HBAC is set to allow_all.
[ root@jira02 log]# cat /etc/sssd/sssd.conf [domain/mgt.example.net]
cache_credentials = True krb5_store_password_if_offline = True krb5_realm = EXAMPLE.NET ipa_domain = mgt.example.net id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = jira02.mgt.example.net chpass_provider = ipa dyndns_update = True ipa_server = _srv_, infra-test-ipa.example.net dyndns_iface = ens160 ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, pam, ssh, sudo
domains = mgt.example.net [nss] homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
[secrets]
[ root@jira02 log]#
Start here: https://docs.pagure.org/SSSD.sssd/users/sudo_troubleshooting.html
rob
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
OK now I need help w/ another aspect of sudo. I need to setup a rule so taht certain users in a group can su - someuser, or sudo su - someuser. I'm having difficulty researching this. Can anyone shed light on this?
On Wednesday, November 8, 2017 2:57 PM, Andrew Meyer via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
I tried to add to much to the rule. I added a RunAs or AuthAs option which killed me.
On Wednesday, November 8, 2017 2:51 PM, Patrick Grove via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
What was the resolution?
Patrick Grove, System Administrator, IT Infrastructure NHK International E-mail: patrick.grove@nhkusa.com Office #: 248 308 5624
----- Original Message ----- From: "Andrew Meyer via FreeIPA-users" freeipa-users@lists.fedorahosted.org To: "Andrew Meyer" andrewm659@yahoo.com, "FreeIPA users list" freeipa-users@lists.fedorahosted.org, "FreeIPA users list" freeipa-users@lists.fedorahosted.org Cc: "Rob Crittenden" rcritten@redhat.com, "Andrew Meyer" andrewm659@yahoo.com Sent: Wednesday, November 8, 2017 3:47:42 PM Subject: [Freeipa-users] Re: FreeIPA sudoers
Nm. I fixed it.
On Wednesday, November 8, 2017 2:28 PM, Andrew Meyer via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
so looking at the logs it find a rule:
(Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_cached_rules_by_user] (0x0400): Replacing sudoUser attribute with sudoUser: #1154600003 (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(sudoUser=+*)(!(|(sudoUser=ALL)(sudoUser=andrew.meyer@mgt.stl.gatewaybl end.net)(sudoUser=#1154600003)(sudoUser=%answers\20jira\20engineers@mgt.stl.example.net)(sudoUser=%answers\20jira\20admins@mgt.stl.example.net)(sudoUser=%example-admins@mgt.s tl.example.net)(sudoUser=%answers\20jira\20users@mgt.stl.example.net)(sudoUser=%ipausers@mgt.stl.example.net)(sudoUser=%admins@mgt.stl.example.net)(sudoUser=%wheel@mgt.s tl.example.net)(sudoUser=%ops_sudoers@mgt.stl.example.net)(sudoUser=%ops@mgt.stl.example.net)(sudoUser=%admins@mgt.stl.example.net))))] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sort_sudo_rules] (0x0400): Sorting rules with higher-wins logic (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 1 rules for [andrew.meyer@mgt.stl.example.net@mgt.stl.example.net] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): error: [0] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rules_num: [0] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rule [1]/[1] (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): cn:All (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): objectClass:sudoRule (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoCommand:ALL (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoHost:ALL (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoOption:!authenticate (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoRunAsUser:process (Wed Nov 8 14:23:29 2017) [sssd[sudo]] [sudosrv_response_append_attr] (0x2000): sudoUser:#1154600003 (Wed Nov 8 14:23:40 2017) [sssd[sudo]] [client_recv] (0x0200): Client disconnected! (Wed Nov 8 14:23:40 2017) [sssd[sudo]] [client_close_fn] (0x2000): Terminated client [0x55fce3abe990][18]
the sssd_hostname log is complaining about no SELinux maps...
On Wednesday, November 8, 2017 1:43 PM, Rob Crittenden via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Andrew Meyer via FreeIPA-users wrote:
Hello, i'm having some trouble getting sudoers to work.
I have 5 machines joined to the FreeIPA domain and I have a user group called ops and ops_sudoers. Both have permission to full sudo.
[ andrew.meyer@jira02 ~]$ ipa sudorule-find ALL
1 Sudo Rule matched
Rule name: All Enabled: TRUE Host category: all Command category: all Sudo Option: !authenticate
Number of entries returned 1
[ andrew.meyer@jira02 ~]$ ipa sudorule-show ALL Rule name: All Enabled: TRUE Host category: all Command category: all Users: brian.keithly, andrew.meyer User Groups: ops_sudoers, ops RunAs Users: process Sudo Option: !authenticate
[ andrew.meyer@jira02 ~]$ sudo su - [sudo] password for andrew.meyer: Sorry, user andrew.meyer is not allowed to execute '/bin/su -' as root on jira02.mgt.example.net. [ andrew.meyer@jira02 ~]$
My HBAC is set to allow_all.
[ root@jira02 log]# cat /etc/sssd/sssd.conf [domain/mgt.example.net]
cache_credentials = True krb5_store_password_if_offline = True krb5_realm = EXAMPLE.NET ipa_domain = mgt.example.net id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = jira02.mgt.example.net chpass_provider = ipa dyndns_update = True ipa_server = _srv_, infra-test-ipa.example.net dyndns_iface = ens160 ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, pam, ssh, sudo
domains = mgt.example.net [nss] homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
[secrets]
[ root@jira02 log]#
Start here: https://docs.pagure.org/SSSD.sssd/users/sudo_troubleshooting.html
rob
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
freeipa-users@lists.fedorahosted.org
-
Andrew Meyer -
Patrick Grove -
Rob Crittenden