<br>After a discussion between my mentor, we decided to support the NOPASSWD option. We are planning to delay the pam authentication after the evaluation of sudo rules.<br><div class="gmail_quote">On Thu, Jul 28, 2011 at 7:31 PM, Gowrishankar Rajaiyan <span dir="ltr"><<a href="mailto:gsr@redhat.com">gsr@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im">On 07/28/2011 06:58 PM, arun scaria wrote:<br>
><br>
><br>
> On Thu, Jul 28, 2011 at 2:10 PM, Gowrishankar Rajaiyan <<a href="mailto:gsr@redhat.com">gsr@redhat.com</a><br>
</div><div class="im">> <mailto:<a href="mailto:gsr@redhat.com">gsr@redhat.com</a>>> wrote:<br>
><br>
> On 07/28/2011 07:22 AM, arun scaria wrote:<br>
> > Hi all,<br>
> > I'v created my write-up on SUDO responder/cache behavior at<br>
> ><br>
> <a href="https://fedorahosted.org/sssd/wiki/DesignDocs/SudoSupport/SudoResponderCacheBehavior" target="_blank">https://fedorahosted.org/sssd/wiki/DesignDocs/SudoSupport/SudoResponderCacheBehavior</a>.<br>
> > I'd love to hear your opinion on it. Please take a review and<br>
> comment.<br>
> ><br>
><br>
> One question:<br>
> How do we plan to include "sudoOption=!authenticate" (where<br>
> !authenticate=NOPASSWD) in a sudorule during offline?<br>
><br>
> The option !authenticate is not specified anywhere in the standard sudo<br>
> schema at <a href="http://www.gratisoft.us/sudo/man/1.8.1/sudoers.ldap.man.html" target="_blank">http://www.gratisoft.us/sudo/man/1.8.1/sudoers.ldap.man.html</a>.<br>
<br>
</div>If you use "sudoers2ldif" tool provided by the sudo package to convert<br>
an existing /etc/sudoers file to an ldif format, the "!authenticate"<br>
value is used.<br>
<br>
/usr/share/doc/sudo-1.7.4p5/sudoers2ldif:<br>
<snip><br>
# if NOPASSWD: directive found, mark entire entry as not requiring<br>
s/NOPASSWD:\s*// && push @options,"!authenticate";<br>
s/PASSWD:\s*// && push @options,"authenticate";<br>
</snip><br>
<div class="im"><br>
> But this option is found in all the blogs and tutorials as the<br>
> alternative to the NOPASSWD option in the sudoers file. In the current<br>
> implementation of sudo plugin we are doing the pam authentication with<br>
> sudo pam config file. This is done before we query the sssd for<br>
> authentication for sudo. So that the user will be requested password<br>
> even if the !authenticate sudoOption is enabled.<br>
><br>
<br>
</div>IMO expecting a password for a runasuser from a sudorule where<br>
sudoOption is set to !authenticate is not an expected behaviour.<br>
<div><div></div><div class="h5">_______________________________________________<br>
sssd-devel mailing list<br>
<a href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
<a href="https://fedorahosted.org/mailman/listinfo/sssd-devel" target="_blank">https://fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Arun Scaria<br>Chairman | MEC Association of Computer Students (MACS)<br>Junior Under Graduate, Computer Science and Engineering (2008-2012)<br>Govt. Model Engineering College<br>
Cochin-21.<br>(M) +918089528527.<br><a href="mailto:arunscaria91@gmail.com" target="_blank">arunscaria91@gmail.com</a><br><div><span style="font-family:verdana,arial;font-size:12px;line-height:16px"><a href="mailto:arunscaria@acm.org" target="_blank">arunscaria@acm.org</a><br>
<a href="mailto:arun.scaria@arbitron.com" target="_blank">arun.scaria@arbitron.com</a><br></span></div><br>