[SSSD-users] sssd_sudo receives 0 rules but ldap search returns 5, what is wrong?
Rowland Penny
repenny241155 at gmail.com
Thu Jul 10 10:20:10 UTC 2014
On 09/07/14 19:00, Rich Megginson wrote:
> re:
> https://lists.fedorahosted.org/pipermail/sssd-users/2014-July/001891.html
> <snip>
>> OK, I take back all that I said over on the samba list, sssd does not
>> pull the sudo rules from AD
>>
>> I have just spent two hours trying to get sssd to get the sudo rules
>> from AD on my netbook that I have just installed Linux Mint mate 17 on,
>> to no effect.
>>
>> after upping sssd debug to 9, I found this search in
>> sssd_example.com.log:
>>
>> (&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=netbook)(sudoHost=netbook.example.com)(sudoHost=192.168.0.229)(sudoHost=192.168.0.0/24)(sudoHost=fe80::1e4b:d6ff:fec0:e307)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*))))
>>
>>
>> If I try to search with this via ldbsearch, it does not work, all I get
>> is this:
>>
>> allocating request failed: Unable to parse search expression
>>
>> If I remove one small part, it does work and displays the sudo roles
>>
>> So, what does this do?
>>
>> (sudoHost=*\**)
>
> I'm not sure what this search is supposed to do. What is the
> intention of this? If it is to search for any sudoHost value with a
> literal asterisk "*" character in it, then the search filter syntax is
> wrong. According to http://tools.ietf.org/html/rfc4515, if you want
> to use a "*" in a search filter, it must be escaped like this: \2A, so
> the search filter would be (sudoHost=*\2A*)
>
>>
>> because I can only get the search to work without it
>>
>> Rowland
>
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
OK, I have done a bit more investigation and I am now of the the opinion
that it is a permissions problem.
If I do this ldapsearch on the client:
ldapsearch -h dc1 -Y GSSAPI -b ou=Sudoers,dc=example,dc=com
'(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=netbook)(sudoHost=netbook.example.com)(sudoHost=192.168.0.229)(sudoHost=192.168.0.0/24)(sudoHost=fe80::1e4b:d6ff:fec0:e307)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*))))'
I get this response:
SASL/GSSAPI authentication started
SASL username: NETBOOK$@EXAMPLE.COM
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <ou=Sudoers,dc=example,dc=com> with scope subtree
# filter:
(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=netbook)(sudoHost=netbook.example.com)(sudoHost=192.168.0.229)(sudoHost=192.168.0.0/24)(sudoHost=fe80::1e4b:d6ff:fec0:e307)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*))))
# requesting: ALL
#
# search result
search: 4
result: 0 Success
# numResponses: 1
But, if I do the ldapsearch this way:
ldapsearch -x -h dc1 -b ou=Sudoers,dc=example,dc=com -D
cn=Administrator,cn=Users,dc=example,dc=com -w xxxxxxxx
'(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=netbook)(sudoHost=netbook.example.com)(sudoHost=192.168.0.229)(sudoHost=192.168.0.0/24)(sudoHost=fe80::1e4b:d6ff:fec0:e307)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*))))'
I get this response:
# extended LDIF
#
# LDAPv3
# base <ou=Sudoers,dc=example,dc=com> with scope subtree
# filter:
(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=netbook)(sudoHost=netbook.example.com)(sudoHost=192.168.0.229)(sudoHost=192.168.0.0/24)(sudoHost=fe80::1e4b:d6ff:fec0:e307)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*))))
# requesting: ALL
#
# defaults, SUDOers, example.com
dn: CN=defaults,OU=SUDOers,dc=example,dc=com
objectClass: top
objectClass: sudoRole
cn: defaults
description: Default sudoOptions go here
instanceType: 4
whenCreated: 20140703100647.0Z
uSNCreated: 7410
name: defaults
objectGUID:: CFeHJYb9kUSpz1xbrqnrOA==
objectCategory: CN=sudoRole,CN=Schema,CN=Configuration,dc=example,dc=com
sudoOption: env_reset
sudoOption: mail_badpass
sudoOption:
secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sb
in:/bin"
sudoHost: ALL
whenChanged: 20140710085142.0Z
uSNChanged: 8889
distinguishedName: CN=defaults,OU=SUDOers,dc=example,dc=com
# rowland, SUDOers, example.com
dn: CN=rowland,OU=SUDOers,dc=example,dc=com
objectClass: top
objectClass: sudoRole
cn: rowland
instanceType: 4
whenCreated: 20140703100648.0Z
uSNCreated: 7412
name: rowland
objectGUID:: KSCH09FZ4kmM9WIV1qxAPg==
objectCategory: CN=sudoRole,CN=Schema,CN=Configuration,dc=example,dc=com
sudoUser: rowland
sudoCommand: ALL
sudoHost: ALL
whenChanged: 20140710085009.0Z
uSNChanged: 8887
distinguishedName: CN=rowland,OU=SUDOers,dc=example,dc=com
# %sudo, SUDOers, example.com
dn: CN=%sudo,OU=SUDOers,dc=example,dc=com
objectClass: top
objectClass: sudoRole
cn: %sudo
instanceType: 4
whenCreated: 20140703100647.0Z
uSNCreated: 7411
name: %sudo
objectGUID:: 0k5Y1dUTjEG0M2UcUJww8g==
objectCategory: CN=sudoRole,CN=Schema,CN=Configuration,dc=example,dc=com
sudoUser: %sudo
sudoCommand: ALL
sudoHost: ALL
whenChanged: 20140710085009.0Z
uSNChanged: 8888
distinguishedName: CN=%sudo,OU=SUDOers,dc=example,dc=com
# search result
search: 2
result: 0 Success
# numResponses: 4
# numEntries: 3
Any suggest to what I check next??
Rowland
More information about the sssd-users
mailing list