LDAP - sudoers and the nopasswd flag - How can i set some commands for wheelgroup without password?
Hello
we use LDAP with sudoers about 4 years. Works fine. But we have one problem with members of the admingroup (wheel). This users can do every command with sudo and with there privat password. But when they also are member to another special group, like sysadmin:
Sysadmin is allowed to use the commands, systemctl, reboot, shutdown, and a couple of other commands without password.
They must nevertheless always enter their password.
The goal is that admins they are in the wheelgroup and also members from some other sudogroups, they can execute there commands without password. Is this possible in LDAP?
Here some config:
The importand option here is !authenticate. With this i can say "execute command without password".
Thanks a lot for helping!
Best Regards
Last edited by Scrutinizer; 03-19-2016 at 01:43 PM..
Reason: Changed noparse to code tags
Hello gurus,
I've been working on a sudoers file to work with groups in LDAP. I've created the groups in LDAP and added the users to there respective groups. I've also setup my sudoers file to have the groups match what is in LDAP. And I've added ldap to nsswitch.conf in the group line. The... (6 Replies)
Hey all,
I'm looking for a script to auto-generate a password for users that forget their password.
Currently, we are using a perl script (with cgi-bin) where users update their password, but would like to add to this and make it so that the users can also request a password reset and a... (1 Reply)
I'm fairly inexperienced with LDAP and DSEE so to build my skills I installed directory server in the global zone of my Sol 10/u7 machine and created a zone to use as a client. For some reason when I try to change a users password as root (in the client zone) with passwd -r ldap I am prompted for... (1 Reply)
Greetings!! I am attempting to solve a rather thorny issue and I was hoping that someone might have some insight into what is going on here..
At this point I have an openLDAP server that is working quite splendidly! :)
I have a working directory with users able to authenticate it and TLS... (2 Replies)
How to change the ldap root password.
I have generated the password by using "slappasswd " command, but In my root machine "/etc/ldap/sldap.d" file is not there. instead of the file sldap.d directory only is there. please help me...? (0 Replies)
Hi,
I have installed open ldap according to the order from this video:
YouTube - bowendenning's Channel
sudo apt-get install slapd
sudo apt-get install ldap-utils
sudo apt-get install phpldapadmin
The installaion was good.
However it did NOT ask from me any password.
After I enter to... (0 Replies)
Hello there,
I hope that I am posting in the right section here, please advise if I posted wrong.
I currently try to change passwords in our Active Directory Envoirenment via LDAP on Linux since the users in question do not have access to a windows-machine and we want to keep it that way. ... (0 Replies)
Hi Unix.com people! :)
My question, I think, it's easy to understand.
I want to configure my sudoers file (/etc/sudoers) in order
to hide automatically, some repetitive and annoying commands
to be listed on auth.log (/var/log/auth.log).
Anyone know something, or know where I can... (0 Replies)
Basically I only want particular users to know the root password, but I also want power users to be able to run certain commands with root privileges. All admins for this box will be authenticating initially through winbind (I do have a backdoor account in case winbind goes wonky)
I want... (0 Replies)
Discussion started by: thmnetwork
0 Replies
LEARN ABOUT DEBIAN
lockout
LOCKOUT(1) lockout LOCKOUT(1)NAME
lockout - avoid slacking and impose productivity and discipline on yourself
WARNING
This program is VERY DANGEROUS. If it fails, you may end up not knowing the root password to your own computer (in which case you need to
boot into single-user mode). There are no known reports of this actually happening, but we don't know how stupid you are. Also, you
should probably not run this on a multi-user system.
SYNOPSIS
lockout lock HhMm | Hh | Mm
lockout lock HH:MM
lockout lock HH:MMam | HH:MMpm
lockout lock HHam | HHpm
lockout lock
lockout unlock [force]
lockout status
DESCRIPTION
Lockout is a tool that imposes discipline on you so that you get some work done. For example, lockout can be used to install a firewall
that does not let you browse the Web. Lockout changes the root password for a specified duration; this prevents you from secretly ripping
down the firewall and then browsing the Web anyway. In case of an emergency, you can reboot your computer to undo the effects of lockout
and to restore the original root password.
Obviously, lockout lock and lockout unlock can only be run by root. lockout status can be run by any user.
lockout without any parameters shows a brief help message.
lockout lock takes one optional parameter. If no parameter is given, you are dropped in interactive mode and asked for the duration of the
lock or the time at which the lock should be lifted. You can also supply this as a parameter on the command line. Lockout understands
various time formats. You can specify a delay, e.g., 3h (3 hours), 1h30m (1 hour and 30 minutes), or 90m (1 hour and 30 minutes), or you
can specify absolute time, e.g., 2pm, 2:30am, 15:30, etc. You will be asked to confirm the time at which lockout will unlock your system.
If you type "yes", lockout executes /etc/lockout/lock.sh and changes the root password to something completely random. /etc/lock-
out/lock.sh is a shell script that you write. It takes measures to make sure you stop slacking. For example, it could install a firewall
that prevents outgoing connections to port 80. See the "EXAMPLES" section below.
lockout unlock takes an optional force parameter. Without any parameters, lockout lock will check whether it is time to unlock the system
and, if so, executes /etc/lockout/unlock.sh, which is a shell script that you write. It should undo the effects of /etc/lockout/lock.sh,
executed when the system was locked. If you pass the force parameter to lockout unlock, lockout will forcibly unlock your system, whether
it was really time for that or not. lockout unlock should be called every minute by cron. See "CONFIGURATION".
lockout status will print out the time at which the system is going to be unlocked.
CONFIGURATION
/etc/cron.d/lockout must contain the following two entries:
*/1 * * * * root /usr/bin/lockout unlock >/dev/null 2>&1
@reboot root /usr/bin/lockout unlock force >/dev/null 2>&1
The examples that follow assume you are using sudo(8) and you have a file, /etc/lockout/sudoers.normal which is the normal /etc/sudoers
file, and /etc/lockout/sudoers.lock, which is the /etc/sudoers file when lockout locks your computer. This example also assumes you are
using iptables(8). /var/lib/iptables/active should contain your default firewall rules, and /var/lib/iptables/work should contain the
firewall rules that enforce discipline. See below for an example.
/etc/lock/lock.sh imposes discipline. For example:
#!/bin/sh
/etc/init.d/iptables load work
cp /etc/lockout/sudoers.lock /etc/sudoers
/etc/init.d/sudo stop
/etc/init.d/sudo start
/etc/lock/unlock.sh undoes these effects. For example:
#!/bin/sh
/etc/init.d/iptables restart
cp /etc/lockout/sudoers.normal /etc/sudoers
/etc/init.d/sudo stop
/etc/init.d/sudo start
Your /var/lib/iptables/work may look something like this:
*filter
:INPUT ACCEPT [1047:99548]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1104:120792]
# allow incoming packets from localhost, ntp,
# and existing connections
-A INPUT -i lo -j ACCEPT
-A INPUT -p udp -m udp --source-port ntp -m state --state ESTABLISHED -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -j DROP
-A INPUT -p udp -j DROP
# allow outgoing connections for email and DNS
-A OUTPUT -d 127.0.0.1/8 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport smtp -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport domain -j ACCEPT
-A OUTPUT -p udp -m udp --dport domain -j ACCEPT
-A OUTPUT -j DROP
COMMIT
EXAMPLES
lockout lock 2h30m [locks out for 2h and 30m]
lockout lock 90m [locks out for 1h and 30m]
lockout lock 3pm [locks out until 3pm]
lockout lock 3:20am [locks out until 3:20am]
lockout lock 15:20 [locks out until 3:20pm]
lockout status [shows when the system is going to be unlocked]
FILES
/etc/lockout/lock.sh: executed when running lockout lock
/etc/lockout/unlock.sh: executed when running lockout unlock
SEE ALSO usermod(8), iptables(8), passwd(1), cron(8), crontab(1)BUGS
Arguably, a program that changes the root password to something random with the possibility of never recovering the original password might
be considered a bug by itself. Other than that, no known bugs.
AUTHOR
Thomer M. Gil, http://thomer.com/lockout/
lockout 2004-09-08 LOCKOUT(1)