https://fedorahosted.org/sssd/ticket/623
Helpful links:
- SUDO plugin API
http://www.gratisoft.us/sudo/man/1.8.1/sudo_plugin.man.html
What does it do currently?
1. sudo plugin sends input data to responder
2. responder sends back to plugin that user is allowed to run the
command
What does it not do?
- Doesn't require any PAM authentication
- Doesn't read anything from LDAP
- Doesn't set any environment variables (and reset current environment)
This actually can cause some troubles to applications, so far I've
encountered an error message in VIM (no $HOME specified)
How to test it?
1. Install SUDO version 1.8 or greater
I am running 1.8.2 built from source:
ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.2.tar.gz
2. Enable SUDO plugin in /etc/sudo.conf
Plugin sss_sudo_policy /usr/lib/sudo/libsss_sudoplugin.so
Unfortunately, SUDO doesn't allow to have more than one policy
plugin activated, so comment out standard sudoers plugin.
3. Enable it in sssd.conf ;-)
services += sudo
4. Run sssd
5. Run sudo
I left there some debug messages, so don't worry when you see:
CMD Return code: 0
errnop: 0
Command exited with status 0
in the output. But tell me if there is anything else than 0 :-)
[PATCH 1/5]
Adds a client function that allows client to send data to responder.
And set sudo responder protocol version.
[PATCH 2/5]
SUDO plugin.
[PATCH 3/5]
SUDO responder.
[PATCH 4/5]
Configure and Makefile updates so we can build plugin and responder.
[PATCH 5/5]
Just a little update that adds sudo responder to known services of monitor.