On Mon, Jan 30, 2017 at 06:45:19PM -0000, mdiorio(a)gmail.com wrote:
Hi Everyone,
I have an AD domain joined system using realmd and that is working
fine. I want to use Group Policy to configure access, and have it set
up. I added my users to the Allow log on through Terminal Services GPO
and I can successfully authenticate and SSH into the system using kerberos
and password auth.
My next problem is SUDO rights - I don't have any. Supposedly, ad_gpo_map_permit is a
list of PAM services that are ALWAYS allowed when using GPO access, and this by default
includes sudo and sudo-i. Yet I can't SUDO.
In /etc/nsswitch.conf I added:
sudoers: files sss
In /etc/sssd.conf I updated:
services = nss, pam, autofs, sudo
This is needed until sssd-1.15 which finally allows the needed services
to be socket-activated
and added the empty [sudo] section.
In the [domain/] section I added:
sudo_provider: ad
This shouldn't be needed; nor should this be harmful.
but from what I've read this isn't needed.
Since I don't want the world to be able to SUDO, I also tried adding to sssd.conf
domain section
ad_gpo_map_service = +sudo,+sudo-i
and added my users to the Allow logon as a service GPO, but still no luck.
My sssd sudo log doesn't look like it's querying GPO for permissions through.
Right, I think you are past the PAM account check (otherwise you wouldn't
be able to authenticate to run sudo at all and pam_sss would fail with
return code 6), but sudo is not matching any rules.
Are your sudo rules stored in AD or locally in /etc/sudoers? I assume
it's in AD, right?
Could you paste one of the rules (feel free to obfuscate the private
data..) ?
In general, you should follow
https://fedorahosted.org/sssd/wiki/HOWTO_Troubleshoot_SUDO to see which
part breaks..if sssd does fetch and cache the rules at all, if sssd
returns the rules to sudo etc..
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_get_rules_send] (0x0400): Running
initgroups for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_send] (0x0400): Cache Request
[Initgroups by name #2]: New request
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_send] (0x0400): Cache Request
[Initgroups by name #2]: Parsing input name [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name
'mdiorio(a)internal.ieeeglobalspec.com' matched expression for domain
'internal.ieeeglobalspec.com', user is mdiorio
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_set_name] (0x0400): Cache Request
[Initgroups by name #2]: Setting name [mdiorio]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_select_domains] (0x0400): Cache
Request [Initgroups by name #2]: Performing a single domain search
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_set_domain] (0x0400): Cache Request
[Initgroups by name #2]: Using domain [
internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_check_ncache] (0x0400): Cache Request
[Initgroups by name #2]: Checking negative cache for
[mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sss_ncache_check_str] (0x2000): Checking
negative cache for
[
NCE/USER/internal.ieeeglobalspec.com/mdiorio@internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_get_object] (0x0200): Cache Request
[Initgroups by name #2]: Requesting info for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_cache_check] (0x0400): Cache Request
[Initgroups by name #2]: [mdiorio(a)internal.ieeeglobalspec.com] entry is valid
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_cache_search] (0x0400): Cache Request
[Initgroups by name #2]: Returning info for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_done] (0x0400): Cache Request
[Initgroups by name #2]: Finished: Success
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb
with
[(&(objectClass=sudoRule)(dataExpireTimestamp<=1485799511)(|(name=defaults)(sudoUser=ALL)(sudoUser=mdiorio(a)internal.ieeeglobalspec.com)(sudoUser=#1002201109)
......
Truncated AD Group query
----
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_refresh_rules_send] (0x0400): No expired
rules were found for [mdiorio@internal.ieeeglobalspec.com(a)internal.ieeeglobalspec.com].
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Retrieving
default options for [mdiorio@internal.ieeeglobalspec.com(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb
with [(&(objectClass=sudoRule)(name=defaults))]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 0
default options for [mdiorio@internal.ieeeglobalspec.com(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): error: [0]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rules_num:
[0]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_cmd] (0x2000): Using protocol version
[1]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_get_rules_send] (0x0400): Running
initgroups for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_send] (0x0400): Cache Request
[Initgroups by name #3]: New request
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_send] (0x0400): Cache Request
[Initgroups by name #3]: Parsing input name [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name
'mdiorio(a)internal.ieeeglobalspec.com' matched expression for domain
'internal.ieeeglobalspec.com', user is mdiorio
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_set_name] (0x0400): Cache Request
[Initgroups by name #3]: Setting name [mdiorio]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_select_domains] (0x0400): Cache
Request [Initgroups by name #3]: Performing a single domain search
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_set_domain] (0x0400): Cache Request
[Initgroups by name #3]: Using domain [
internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_check_ncache] (0x0400): Cache Request
[Initgroups by name #3]: Checking negative cache for
[mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sss_ncache_check_str] (0x2000): Checking
negative cache for
[
NCE/USER/internal.ieeeglobalspec.com/mdiorio@internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_get_object] (0x0200): Cache Request
[Initgroups by name #3]: Requesting info for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_cache_check] (0x0400): Cache Request
[Initgroups by name #3]: [mdiorio(a)internal.ieeeglobalspec.com] entry is valid
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_cache_search] (0x0400): Cache Request
[Initgroups by name #3]: Returning info for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_done] (0x0400): Cache Request
[Initgroups by name #3]: Finished: Success
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb
with
[(&(objectClass=sudoRule)(dataExpireTimestamp<=1485799511)(|(name=defaults)(sudoUser=ALL)(sudoUser=mdiorio(a)internal.ieeeglobalspec.com)(sudoUser=#1002201109)
--------------
Truncated group query
--------------
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 0 rules
for [mdiorio@internal.ieeeglobalspec.com(a)internal.ieeeglobalspec.com]
Yeah, sssd doesn't return any rules, but the domain log should also show
if any rules were fetched for the host..
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_build_response]
(0x2000): error: [0]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rules_num:
[0]
(Mon Jan 30 13:05:13 2017) [sssd[sudo]] [client_recv] (0x0200): Client disconnected!
(Mon Jan 30 13:05:13 2017) [sssd[sudo]] [client_close_fn] (0x2000): Terminated client
[0x7f95cfb03870][20]
One thing I do find strange is that it appears to be trying to find user@domain@domain
This is a minor bug, feel free to open one at
https://fedorahosted.org/sssd/newticket, but I'm quite confident it's just
a bad debug message, not sssd actually double-qualifying the name..