使用FreeIPA进行中央sudo – 使用SSSD做sudoers

我已经为中央sudo设置了FreeIPA，除了能够为sudoers使用SSSD之外，所有的工作都很好。

如果我在我的客户端/etc/nsswitch.conf中有以下内容：

sudoers: files ldap 

当FreeIPA服务器可用时，sudo命令可以按需要工作。 不过，我想使用SSSD，以便在FreeIPA服务器不可用的情况下，sudo仍然可以工作。

当我在我的客户端/etc/nsswitch.conf中有以下内容：

• 使用FreeIPA集中sudo – 如何指定所有命令？
• freeipa ssl ldap和round robin dns
• Windows 7 NFS客户端使用Kerberos和Linux KDC
• IPAdynamicDNS只更新AAAAlogging。 我的Alogging在哪里？
• IPA与仅用于Linux的LDAP的盒子 – 寻找比较

 sudoers: files sss 

而我的/etc/sssd/sssd.conf如下：

 [domain/example.com] cache_credentials = True ipa_domain = example.com id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = host3.example.com chpass_provider = ipa ipa_server = _srv_, ipa.example.com ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, pam, ssh, sudo config_file_version = 2 domains = example.com ldap_sudo_search_base = ou=SUDOers,dc=example,dc=com . . . [snip] 

并尝试运行sudo我会得到：

user1不允许在host3上运行sudo。 这个事件将被报道。

这是一个不同的错误：

user1不在sudoers文件中。 这个事件将被报道。

这使我相信SSSD实际上已经从FreeIPA中获得了一些东西，但是它所得到的却是某种错误。 我在FreeIPA服务器上唯一的一个难题是：

 [root@ipa ~]# ipa sudorule-find ------------------- 1 Sudo Rule matched ------------------- Rule name: All Enabled: TRUE Host category: all Command category: all RunAs User category: all User Groups: admins ---------------------------- Number of entries returned 1 ---------------------------- 

和我发布sudo的用户在pipe理员组中（当在nsswitch.conf中指定了ldap时，它也可以工作）。

我错过了什么？

更新1：

相信我的sssd.conf是不正确的，已经更新包括：

 sudo_provider = ldap ldap_uri = ldap://ipa.example.com ldap_sudo_search_base = ou=SUDOers,dc=example,dc=com ldap_sasl_mech = GSSAPI ldap_sasl_authid = host/host3.example.com ldap_sasl_realm = EXAMPLE.COM krb5_server = ipa.example.com [sssd] services = nss, pam, ssh, sudo config_file_version = 2 domains = example.com . . . [snip] 

得到相同的消息，即：

user1不允许在host3上运行sudo。 这个事件将被报道。

更新2：

我打开SSSDdebugging，即编辑/etc/sssd/sssd.conf并添加：

 debug_level = 5 

然后我检查了/var/log/sssd/sssd_example.com.log。 在这里我注意到SSSD不喜欢CAPITALS的值为ldap_sudo_search_base ，即当我有

 ldap_sudo_search_base = ou=SUDOers,dc=example,dc=com 

我在日志中注意到根本没有ldap_sudo_search_base条目。 当我更改为小写ou=sudoers我在日志中看到了这个条目，例如：

 (Thu Dec 12 18:58:31 2013) [sssd[be[example.com]]] [common_parse_search_base] (0x0100): Search base added: [SUDO][ou=sudoers,dc=example,dc=com][SUBTREE][] 

我仍然得到相同的user1 is not allowed to run sudo on host3. 所以还是没有解决。

更新3

 (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [accept_fd_handler] (0x0400): Client connected! (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sss_cmd_get_version] (0x0200): Received client version [1]. (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sss_cmd_get_version] (0x0200): Offered version [1]. (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'user1' matched without domain, user is user1 (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'user1' matched without domain, user is user1 (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_cmd_parse_query_done] (0x0200): Requesting default options for [user1] from [<ALL>] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requesting info about [[email protected]] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_user] (0x0400): Returning info for user [[email protected]] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_rules] (0x0400): Retrieving default options for [user1] from [example.com] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=user1)(sudoUser=#1219400005)(sudoUser=%apache)(sudoUser=%superadmins)(sudoUser=%user1)(sudoUser=+*))(&(dataExpireTimestamp<=1387476127)))] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_rules] (0x2000): About to get sudo rules from cache (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(name=defaults)))] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_sudorules_from_cache] (0x0400): Returning 0 rules for [<default options>@example.com] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'user1' matched without domain, user is user1 (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'user1' matched without domain, user is user1 (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_cmd_parse_query_done] (0x0200): Requesting rules for [user1] from [<ALL>] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requesting info about [[email protected]] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_user] (0x0400): Returning info for user [[email protected]] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_rules] (0x0400): Retrieving rules for [user1] from [example.com] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=user1)(sudoUser=#1219400005)(sudoUser=%apache)(sudoUser=%superadmins)(sudoUser=%user1)(sudoUser=+*))(&(dataExpireTimestamp<=1387476127)))] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_rules] (0x2000): About to get sudo rules from cache (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=user1)(sudoUser=#1219400005)(sudoUser=%apache)(sudoUser=%superadmins)(sudoUser=%user1)(sudoUser=+*)))] (Thu Dec 19 18:02:07 2013) [sssd[sudo]] [sudosrv_get_sudorules_from_cache] (0x0400): Returning 0 rules for [[email protected]] (Thu Dec 19 18:02:11 2013) [sssd[sudo]] [client_recv] (0x0200): Client disconnected! (Thu Dec 19 18:02:11 2013) [sssd[sudo]] [client_destructor] (0x2000): Terminated client [0x2095c60][18] 

 [root@id ~]# nisdomainname example.com [root@id ~]# sudo -U admin -l Matching Defaults entries for admin on this host: requiretty, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin User admin may run the following commands on this host: (root) /usr/bin/bash [root@id ~]# LANG=en_US.utf8 ipa sudorule-show admins --all dn: ipaUniqueID=83814998-68c1-11e3-a7ad-001a4a418612,cn=sudorules,cn=sudo,dc=example,dc=com Rule name: admins Enabled: TRUE User Groups: admins Hosts: id.example.com Sudo Allow Commands: /usr/bin/bash RunAs External User: root ipauniqueid: 83814998-68c1-11e3-a7ad-001a4a418612 objectclass: ipaassociation, ipasudorule [root@id ~]# su - admin [admin@id ~]$ sudo /usr/bin/bash [sudo] password for admin: [root@id admin]# exit [admin@id ~]$