On Fri, 2011-04-29 at 09:47 +0200, Andy Kannberg wrote:
Hi all,
Currently, we run SSSD on a RHEL5 update 4 box. SSSD version is 1.2.1.
For the main purpose we need it, caching credentials, it works like a
charm.
Now, we have a custom compiled sudo version (sudo 1.6) which does
query LDAP for the sudo rules.
I was testing if sudo still worked while using cached credentials.
(Which is one of the requirements of the project, as users are not
allowed root access)
and it did work. I simply pulled the network cable out of the network
interface, rebooted the machine, logged in with cached credentials and
tried a sudo su - (Which I am allowed to do). And it worked. Is this
intended behaviour, am I looking at the wrong things or did I discover
a 'hidden feature/anomaly'due to the custom sudo version ?
I tried searching on sudo and sssd with google, I only read articles
that sudo and sssd are not integrated yet(but in the works), so I am
wondering how this works.
Andy,
sssd will allow authentication through PAM for any process, sudo
included, and, if offline, it will allow authentication through offlined
credentials.
If you have NOPASSWD set in your sudo configuration for the su - command
it won't ask you a password nor talk with any other component of the
box.
If you don't have NOPASSWD then it will ask for your normal user
password and go through the PAM stack to sssd_pam, which may allow you
to authenticate through offline credentials, if offline, or by doing a
normal online password check.
What is it that surprised you ? It looks like normal behavior to me
(from the sssd pov).
Simo.
--
Simo Sorce * Red Hat, Inc * New York