LDAP - sudoers and the nopasswd flag - How can i set some commands for wheelgroup without password?
Hello
we use LDAP with sudoers about 4 years. Works fine. But we have one problem with members of the admingroup (wheel). This users can do every command with sudo and with there privat password. But when they also are member to another special group, like sysadmin:
Sysadmin is allowed to use the commands, systemctl, reboot, shutdown, and a couple of other commands without password.
They must nevertheless always enter their password.
The goal is that admins they are in the wheelgroup and also members from some other sudogroups, they can execute there commands without password. Is this possible in LDAP?
Here some config:
Code:
cn=defaults
dn cn=defaults,ou=SUDOers,ou=Anwendungen,dc=osit,dc=cc
cn defaults
description sudoOption's
objectClass sudoRole
sudoOption !root_sudo
!lecture
log_host
log_year
ignore_dot
passwd_tries=3
timestamp_timeout=5
passwd_timeout=1
authenticate
ignore_local_sudoers
cn=%wheel
dn cn=%wheel,ou=SUDOers,ou=Anwendungen,dc=osit,dc=cc
cn %wheel
description Superadmingroup
objectClass sudoRole
sudoCommand ALL
sudoHost ALL
sudoUser %wheel
cn=portage
dn cn=portage,ou=SUDOers,ou=Anwendungen,dc=osit,dc=cc
cn portage
description Mitglieder können auf allen Gentoos die Paketverwaltung bedienen.
objectClass sudoRole
sudoCommand /usr/bin/emerge
/usr/bin/eix
/usr/bin/revdep-rebuild
sudoHost ALL
sudoOption !authenticate
sudoUser %portage
The importand option here is !authenticate. With this i can say "execute command without password".
Thanks a lot for helping!
Best Regards
Last edited by Scrutinizer; 03-19-2016 at 01:43 PM..
Reason: Changed noparse to code tags
Hello gurus,
I've been working on a sudoers file to work with groups in LDAP. I've created the groups in LDAP and added the users to there respective groups. I've also setup my sudoers file to have the groups match what is in LDAP. And I've added ldap to nsswitch.conf in the group line. The... (6 Replies)
Hey all,
I'm looking for a script to auto-generate a password for users that forget their password.
Currently, we are using a perl script (with cgi-bin) where users update their password, but would like to add to this and make it so that the users can also request a password reset and a... (1 Reply)
I'm fairly inexperienced with LDAP and DSEE so to build my skills I installed directory server in the global zone of my Sol 10/u7 machine and created a zone to use as a client. For some reason when I try to change a users password as root (in the client zone) with passwd -r ldap I am prompted for... (1 Reply)
Greetings!! I am attempting to solve a rather thorny issue and I was hoping that someone might have some insight into what is going on here..
At this point I have an openLDAP server that is working quite splendidly! :)
I have a working directory with users able to authenticate it and TLS... (2 Replies)
How to change the ldap root password.
I have generated the password by using "slappasswd " command, but In my root machine "/etc/ldap/sldap.d" file is not there. instead of the file sldap.d directory only is there. please help me...? (0 Replies)
Hi,
I have installed open ldap according to the order from this video:
YouTube - bowendenning's Channel
sudo apt-get install slapd
sudo apt-get install ldap-utils
sudo apt-get install phpldapadmin
The installaion was good.
However it did NOT ask from me any password.
After I enter to... (0 Replies)
Hello there,
I hope that I am posting in the right section here, please advise if I posted wrong.
I currently try to change passwords in our Active Directory Envoirenment via LDAP on Linux since the users in question do not have access to a windows-machine and we want to keep it that way. ... (0 Replies)
Hi Unix.com people! :)
My question, I think, it's easy to understand.
I want to configure my sudoers file (/etc/sudoers) in order
to hide automatically, some repetitive and annoying commands
to be listed on auth.log (/var/log/auth.log).
Anyone know something, or know where I can... (0 Replies)
Basically I only want particular users to know the root password, but I also want power users to be able to run certain commands with root privileges. All admins for this box will be authenticating initially through winbind (I do have a backdoor account in case winbind goes wonky)
I want... (0 Replies)
Discussion started by: thmnetwork
0 Replies
LEARN ABOUT CENTOS
net::ldap::extra::ad
Net::LDAP::Extra::AD(3) User Contributed Perl Documentation Net::LDAP::Extra::AD(3)NAME
Net::LDAP::Extra::AD -- AD convenience methods
SYNOPSIS
use Net::LDAP::Extra qw(AD);
$ldap = Net::LDAP->new( ... );
...
if ($ldap->is_AD || $ldap->is_ADAM) {
$ldap->change_ADpassword($dn, $old_password, $new_password);
}
DESCRIPTION
Net::LDAP::Extra::AD tries to spare users the necessity to reinvent the wheel again and again in order to correctly encode password strings
so that they can be used in AD password change operations.
To do so, it provides the following methods:
METHODS
is_AD ( )
Tell if the LDAP server queried is an Active Directory Domain Controller.
As the check is done by querying the root DSE of the directory, it works without being bound to the directory.
is_ADAM ( )
Tell if the LDAP server queried is running AD LDS (Active Directory Lightweight Directory Services), previously known as ADAM (Active
Directoy Application Mode).
As the check is done by querying the root DSE of the directory, it works without being bound to the directory.
change_ADpassword ( DN, OLD_PASSWORD, NEW_PASSWORD )
Change the password of the account given by DN from its old value OLD_PASSWORD to the new value NEW_PASSWORD.
This method requires encrypted connections.
reset_ADpassword ( DN, NEW_PASSWORD, OPTIONS )
Reset the password of the account given by DN to the value given in NEW_PASSWORD. OPTIONS is a list of key/value pairs. The following
keys are recognized:
force_change
If TRUE, the affected user is required to change the password at next login.
For this method to work, the caller needs to be bound to AD with sufficient permissions, and the connection needs to be encrypted.
AUTHOR
Peter Marschall <peter@adpm.de<gt>
COPYRIGHT
Copyright (c) 2012 Peter Marschall. All rights reserved. This program is free software; you can redistribute it and/or modify it under the
same terms as Perl itself.
perl v5.16.3 2013-06-07 Net::LDAP::Extra::AD(3)
03-19-2016
