Simo,

What surprised me was that it also works for sudo rules that are delivered via LDAP.
We don't have a local sudoers file, but all sudo rules are in LDAP.

Which means, that when a users logs in on the system, the sudo rules for that user must be cached also by SSSD.


cheers,
Andy

2011/4/29 Simo Sorce <ssorce@redhat.com>
On Fri, 2011-04-29 at 09:47 +0200, Andy Kannberg wrote:
> Hi all,
>
> Currently, we run SSSD on a RHEL5 update 4 box. SSSD version is 1.2.1.
> For the main purpose we need it, caching credentials, it works like a
> charm.
> Now, we have a custom compiled sudo version (sudo 1.6) which does
> query LDAP for the sudo rules.
>
>  I was testing if sudo still worked while using cached credentials.
> (Which is one of the requirements of the project, as users are not
> allowed root access)
> and it did work. I simply pulled the network cable out of the network
> interface, rebooted the machine, logged in with cached credentials and
> tried a sudo su - (Which I am allowed to do). And it worked. Is this
> intended behaviour, am I looking at the wrong things or did I discover
> a 'hidden feature/anomaly'due to the custom sudo version ?
>
> I tried searching on sudo and sssd with google, I only read articles
> that sudo and sssd are not integrated yet(but in the works), so I am
> wondering how this works.

Andy,
sssd will allow authentication through PAM for any process, sudo
included, and, if offline, it will allow authentication through offlined
credentials.

If you have NOPASSWD set in your sudo configuration for the su - command
it won't ask you a password nor talk with any other component of the
box.
If you don't have NOPASSWD then it will ask for your normal user
password and go through the PAM stack to sssd_pam, which may allow you
to authenticate through offline credentials, if offline, or by doing a
normal online password check.

What is it that surprised you ? It looks like normal behavior to me
(from the sssd pov).

Simo.

--
Simo Sorce * Red Hat, Inc * New York

_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel