Hi Everyone,
I have an AD domain joined system using realmd and that is working fine. I want to use
Group Policy to configure access, and have it set up. I added my users to the Allow log on
through Terminal Services GPO and I can successfully authenticate and SSH into the system
using kerberos and password auth.
My next problem is SUDO rights - I don't have any. Supposedly, ad_gpo_map_permit is a
list of PAM services that are ALWAYS allowed when using GPO access, and this by default
includes sudo and sudo-i. Yet I can't SUDO.
In /etc/nsswitch.conf I added:
sudoers: files sss
In /etc/sssd.conf I updated:
services = nss, pam, autofs, sudo
and added the empty [sudo] section.
In the [domain/] section I added:
sudo_provider: ad
but from what I've read this isn't needed.
Since I don't want the world to be able to SUDO, I also tried adding to sssd.conf
domain section
ad_gpo_map_service = +sudo,+sudo-i
and added my users to the Allow logon as a service GPO, but still no luck.
My sssd sudo log doesn't look like it's querying GPO for permissions through.
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_get_rules_send] (0x0400): Running
initgroups for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_send] (0x0400): Cache Request
[Initgroups by name #2]: New request
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_send] (0x0400): Cache Request
[Initgroups by name #2]: Parsing input name [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name
'mdiorio(a)internal.ieeeglobalspec.com' matched expression for domain
'internal.ieeeglobalspec.com', user is mdiorio
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_set_name] (0x0400): Cache Request
[Initgroups by name #2]: Setting name [mdiorio]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_select_domains] (0x0400): Cache Request
[Initgroups by name #2]: Performing a single domain search
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_set_domain] (0x0400): Cache Request
[Initgroups by name #2]: Using domain [
internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_check_ncache] (0x0400): Cache Request
[Initgroups by name #2]: Checking negative cache for
[mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sss_ncache_check_str] (0x2000): Checking negative
cache for [
NCE/USER/internal.ieeeglobalspec.com/mdiorio@internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_get_object] (0x0200): Cache Request
[Initgroups by name #2]: Requesting info for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_cache_check] (0x0400): Cache Request
[Initgroups by name #2]: [mdiorio(a)internal.ieeeglobalspec.com] entry is valid
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_cache_search] (0x0400): Cache Request
[Initgroups by name #2]: Returning info for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_done] (0x0400): Cache Request
[Initgroups by name #2]: Finished: Success
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb
with
[(&(objectClass=sudoRule)(dataExpireTimestamp<=1485799511)(|(name=defaults)(sudoUser=ALL)(sudoUser=mdiorio(a)internal.ieeeglobalspec.com)(sudoUser=#1002201109)
......
Truncated AD Group query
----
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_refresh_rules_send] (0x0400): No expired
rules were found for [mdiorio@internal.ieeeglobalspec.com(a)internal.ieeeglobalspec.com].
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Retrieving default
options for [mdiorio@internal.ieeeglobalspec.com(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb
with [(&(objectClass=sudoRule)(name=defaults))]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 0
default options for [mdiorio@internal.ieeeglobalspec.com(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): error: [0]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rules_num: [0]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_cmd] (0x2000): Using protocol version
[1]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_get_rules_send] (0x0400): Running
initgroups for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_send] (0x0400): Cache Request
[Initgroups by name #3]: New request
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_send] (0x0400): Cache Request
[Initgroups by name #3]: Parsing input name [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name
'mdiorio(a)internal.ieeeglobalspec.com' matched expression for domain
'internal.ieeeglobalspec.com', user is mdiorio
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_set_name] (0x0400): Cache Request
[Initgroups by name #3]: Setting name [mdiorio]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_select_domains] (0x0400): Cache Request
[Initgroups by name #3]: Performing a single domain search
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_set_domain] (0x0400): Cache Request
[Initgroups by name #3]: Using domain [
internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_check_ncache] (0x0400): Cache Request
[Initgroups by name #3]: Checking negative cache for
[mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sss_ncache_check_str] (0x2000): Checking negative
cache for [
NCE/USER/internal.ieeeglobalspec.com/mdiorio@internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_get_object] (0x0200): Cache Request
[Initgroups by name #3]: Requesting info for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_cache_check] (0x0400): Cache Request
[Initgroups by name #3]: [mdiorio(a)internal.ieeeglobalspec.com] entry is valid
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_cache_search] (0x0400): Cache Request
[Initgroups by name #3]: Returning info for [mdiorio(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [cache_req_done] (0x0400): Cache Request
[Initgroups by name #3]: Finished: Success
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb
with
[(&(objectClass=sudoRule)(dataExpireTimestamp<=1485799511)(|(name=defaults)(sudoUser=ALL)(sudoUser=mdiorio(a)internal.ieeeglobalspec.com)(sudoUser=#1002201109)
--------------
Truncated group query
--------------
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 0 rules
for [mdiorio@internal.ieeeglobalspec.com(a)internal.ieeeglobalspec.com]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): error: [0]
(Mon Jan 30 13:05:11 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rules_num: [0]
(Mon Jan 30 13:05:13 2017) [sssd[sudo]] [client_recv] (0x0200): Client disconnected!
(Mon Jan 30 13:05:13 2017) [sssd[sudo]] [client_close_fn] (0x2000): Terminated client
[0x7f95cfb03870][20]
One thing I do find strange is that it appears to be trying to find user@domain@domain
Any thoughts - I thought I had this all figured out, but I'm probably missing
something simple.
Thanks!