On Mon, Aug 11, 2014 at 12:28:33PM -0700, Michichael Folfsunè wrote:
>Anyway, this discussion started as a thread about mapping sudo to
either
>InteractiveLogonRight or RemoteLogonRight. It sounds to me that
>Michichael and Simo are for moving sudo to the Remote bucked. Is that
>right?
Negative - we're for removing it from GPO checks entirely.
Umm I guess this /is/ technically doable although we would need to
document the special case very carefully. Also, any custom PAM service
built around sudo (one that would maybe include sudo) would break, so
proper documentation is really paramount.
I've also reached out to the sudo maintainer to gather his view on sudo
calling the account PAM phase to make sure we're not missing something.