Sponsored Content
Operating Systems Solaris sudoers file with groups in LDAP Post 302258067 by em23 on Thursday 13th of November 2008 09:01:42 PM
Old 11-13-2008
sudoers file with groups in LDAP

Hello gurus,

I've been working on a sudoers file to work with groups in LDAP. I've created the groups in LDAP and added the users to there respective groups. I've also setup my sudoers file to have the groups match what is in LDAP. And I've added ldap to nsswitch.conf in the group line. The problem is that when a user tries to sudo to a user within their group(s) it errors out saying the user is not in the sudoers file. Also, when I do 'id -a username' it will show the uid, the gid and the group. Has anyone done this before, and if so, what am I missing?

Thanks,

==============================

nsswitch.conf
group: files nis ldap

sample of my sudoers file
##################
# User alias specification #
##################

User_Alias SYSADMIN=%sysadmin
User_Alias DBADMIN=%dba

##################
#Cmnd alias specification#
##################

#GID 14 SYSADMIN is for System Administrators who require ROOT access
# !!!NOTE - THIS GROUP GIVES ROOT ACCESS ON ALL SYSTEMS!!!!
Cmnd_Alias ROOTSHELLS =\
/bin/su -, \
/bin/sh, \
/bin/csh, \
/bin/bash, \
/usr/bin/bash, \
/bin/ksh


#GID 101 DBADMIN is used primarily for the DBA group
Cmnd_Alias DB_ADMIN=\
/bin/su - , \
/bin/sh , \
/bin/csh , \
/bin/su - oracle, \
/bin/kill ?*, \
/bin/rm -i ?*


#####################
# User privilege specification #
#####################

root ALL=(ALL) ALL
SYSADMIN ALL_SERVERS = NOPASSWD:ROOTSHELLS
DBADMIN ALL_SERVERS = DB_ADMIN
 

10 More Discussions You Might Find Interesting

1. Linux

sudoers file

Hi, I have edited 'sudoers' file to allow 'cads' user shutdown the system without providing a password. Can someone tell me what's wrong with my file? It's not working when I 'sudo SHUTDOWN' command: sudo: SHUTDOWN: command not found Thanks a lot! # Host alias specification... (4 Replies)
Discussion started by: whatisthis
4 Replies

2. Red Hat

LDAP auth, secondary groups doesnt works

RedHat ELS 5.2 & Sun directory getent passwd: works toto:*:1000:100:toto:/home/toto:/bin/bash getent group: works mygroup:*:10001:1000,1001 but id toto doesnt works :( uid=1000(toto) gid=100(users) groupes=100(users) BTW in /etc/ldap.conf i use a different mapping for the posix... (4 Replies)
Discussion started by: sncr24
4 Replies

3. Linux

Secondary groups not working with NFS (+LDAP)

I´m using LDAP for groups and NFS for home dirs. My problem is as follows: I only have a few groups, so it's not the problem everyone else had. When I've mounted a disk over NFS, I need to have my primary group in order to read in the groups I'm a member of. Secondary groups is not working. ... (0 Replies)
Discussion started by: velmont
0 Replies

4. UNIX for Advanced & Expert Users

sudoers file

i have defined a rule in the sudoers file so a specific user is able to run some commands as sudo with no password. my question is: is it possible to restrict a user to run commands as sudo only in a certain directory? for example: chown only the files that are located in /var/tmp. Thank you. ... (2 Replies)
Discussion started by: noam128
2 Replies

5. UNIX and Linux Applications

Problems Hooking Sudoers into PAM/LDAP

Greetings!! I am attempting to solve a rather thorny issue and I was hoping that someone might have some insight into what is going on here.. At this point I have an openLDAP server that is working quite splendidly! :) I have a working directory with users able to authenticate it and TLS... (2 Replies)
Discussion started by: bluethundr
2 Replies

6. Shell Programming and Scripting

Addsudoers: A script to add users or groups into /etc/sudoers

Well, sudo is a great tool for delegating permissions among admins. But, it's really hard to find a great tool which would give an interactive way of editing /etc/sudoers file. Now, when I say "editing", I really refer to add new groups, users, aliases in the /etc/sudoers file. visudo is great... (2 Replies)
Discussion started by: admin_xor
2 Replies

7. UNIX for Dummies Questions & Answers

ldap , search groups that user belong

i want run query to identify witch groups that user A belong, CN=name,CN=Users,DC=mydomain ?? (1 Reply)
Discussion started by: prpkrk
1 Replies

8. UNIX for Dummies Questions & Answers

Help with Sudoers file

Hi using Solaris 10. trying to update /etc/sudoers file I need to add all the fist level operation team. This is what I have but it doesn't seem to work. Please help.Error message sudo su - >>> sudoers file: parse error, line 9 <<< >>> sudoers file: parse error, line 9 <<< ... (2 Replies)
Discussion started by: samnyc
2 Replies

9. Solaris

Sudoers file

In the sudoers file in Solaris... I am trying to limit the DEVELOPER user privileges to where those users can only use the “rm” command in certain directories. This is to prevent them from deleting directories or files and destroying a server. I want them to be able to use the "rm" command but... (1 Reply)
Discussion started by: nzonefx
1 Replies

10. UNIX and Linux Applications

LDAP - sudoers and the nopasswd flag - How can i set some commands for wheelgroup without password?

Hello :) we use LDAP with sudoers about 4 years. Works fine. But we have one problem with members of the admingroup (wheel). This users can do every command with sudo and with there privat password. But when they also are member to another special group, like sysadmin: Sysadmin is allowed to... (0 Replies)
Discussion started by: darktux
0 Replies
ADDUSER(8)						      System Manager's Manual							ADDUSER(8)

NAME
adduser - procedure for adding new users DESCRIPTION
A new user must choose a login name, which must not already appear in /etc/passwdor /etc/aliases. It must also not begin with the hyphen (``-'') character. It is strongly recommended that it be all lower-case, and not contain the dot (``.'') character, as that tends to con- fuse mailers. An account can be added by editing a line into the passwd file; this must be done with the password file locked e.g. by using chpass(1) or vipw(8). A new user is given a group and user id. Login's and user id's should be unique across the system, and often across a group of systems, since they are used to control file access. Typically, users working on similar projects will be put in the same groups. At the Univer- sity of California, Berkeley, we have groups for system staff, faculty, graduate students, and special groups for large projects. A skeletal account for a new user "ernie" might look like: ernie::25:30::0:0:Ernie Kovacs,508 Evans Hall,x7925,642-8202:/a/users/ernie:/bin/csh For a description of each of these fields, see passwd(5). It is useful to give new users some help in getting started, supplying them with a few skeletal files such as .profile if they use "/bin/sh", or .cshrc and .login if they use "/bin/csh". The directory "/usr/skel" contains skeletal definitions of such files. New users should be given copies of these files which, for instance, use tset(1) automatically at each login. FILES
/etc/master.passwd user database /usr/skel skeletal login directory SEE ALSO
chpass(1), finger(1), passwd(1), aliases(5), passwd(5), mkpasswd(8), vipw(8) BUGS
User information should (and eventually will) be stored elsewhere. 4th Berkeley Distribution October 23, 1996 ADDUSER(8)
All times are GMT -4. The time now is 09:02 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy