[SSSD] SSSD & sudo

Andy Kannberg andy.kannberg at gmail.com
Fri Apr 29 12:21:36 UTC 2011


Simo,

What surprised me was that it also works for sudo rules that are delivered
via LDAP.
We don't have a local sudoers file, but all sudo rules are in LDAP.

Which means, that when a users logs in on the system, the sudo rules for
that user must be cached also by SSSD.


cheers,
Andy

2011/4/29 Simo Sorce <ssorce at redhat.com>

> On Fri, 2011-04-29 at 09:47 +0200, Andy Kannberg wrote:
> > Hi all,
> >
> > Currently, we run SSSD on a RHEL5 update 4 box. SSSD version is 1.2.1.
> > For the main purpose we need it, caching credentials, it works like a
> > charm.
> > Now, we have a custom compiled sudo version (sudo 1.6) which does
> > query LDAP for the sudo rules.
> >
> >  I was testing if sudo still worked while using cached credentials.
> > (Which is one of the requirements of the project, as users are not
> > allowed root access)
> > and it did work. I simply pulled the network cable out of the network
> > interface, rebooted the machine, logged in with cached credentials and
> > tried a sudo su - (Which I am allowed to do). And it worked. Is this
> > intended behaviour, am I looking at the wrong things or did I discover
> > a 'hidden feature/anomaly'due to the custom sudo version ?
> >
> > I tried searching on sudo and sssd with google, I only read articles
> > that sudo and sssd are not integrated yet(but in the works), so I am
> > wondering how this works.
>
> Andy,
> sssd will allow authentication through PAM for any process, sudo
> included, and, if offline, it will allow authentication through offlined
> credentials.
>
> If you have NOPASSWD set in your sudo configuration for the su - command
> it won't ask you a password nor talk with any other component of the
> box.
> If you don't have NOPASSWD then it will ask for your normal user
> password and go through the PAM stack to sssd_pam, which may allow you
> to authenticate through offline credentials, if offline, or by doing a
> normal online password check.
>
> What is it that surprised you ? It looks like normal behavior to me
> (from the sssd pov).
>
> Simo.
>
> --
> Simo Sorce * Red Hat, Inc * New York
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110429/4c289cc7/attachment.html>


More information about the sssd-devel mailing list