03-14-2005
sudo logging + NFS hang?
Hi all,
I have two problems, My system is SunOS 5.9:
1- I have installed sudo but I have a problem logging user activities on other hosts, the way I installed it is that I installed sudo and the sudoers file in a shared directory on a NFS server which is mounted by all computers on the newtork. I have configured the sudoers file to log into a file in the shared directory by the following command:
Defaults logfile=/share/sudo.log
but this only works for command that are run on the server itself, and won't log commands done on hosts. Any way to solve this problem?
2- My manager requested a configuration of NFS servers where all the computers can see the hard drives of all other computers, so I changed the /etc/dfs/sharetab to share the root directory on all the machines and I changed the /etc/vfstab to mount the root directories of all other machines on each machine. This configuration works fine, but when a machine is turned off the other machines will not restart successfully nor will they see other working remote machines. I guess this is because of the lack of a timeout mechanism in the NFS configuration, is there anyway to configure an NFS client to stop looking for a remote server after, for example, 5 seconds of no response, and then give control back to kernel?
Thanks!
10 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
Hi there,
It might seem tricky, I confess.
We use sudo to allow people to initiate priviledged commands (but not all commands) on our Unix systems.
To by pass this, some people initiate the sudo su - command ;
The main issue is to 'know' what those people do when they gain root access.... (4 Replies)
Discussion started by: linuxmtl
4 Replies
2. UNIX for Dummies Questions & Answers
Hi, I have a Unix box running HP-UX 10.20 and it suddenly won't boot. Every time it goes down the boot checklist, it hangs on "NFS client subsystem" and just continues to say busy/wait. I have read something about the /etc/auto_master but don't quite understand what has to happen to fix it. ... (4 Replies)
Discussion started by: Asheley Ryan
4 Replies
3. HP-UX
Jul 14 08:02:40 servera sshd: Accepted keyboard-interactive/pam for someuser from x.x.x.x port 1406 ssh2
Jul 14 08:02:48 servera su: - 1 someuser-root
Jul 14 08:03:03 servera sudo: someuser : TTY=pts/1 ; PWD=/home/someuser ; USER=root ; COMMAND=/usr/bin/su -
Jul 14 08:03:03 servera su: + 1... (3 Replies)
Discussion started by: Ikon
3 Replies
4. Solaris
Hi all
I had a server, when run the df -h command, it hang, and need to press "crtl+c" to terminate it.
i cant other NFS filesystem anymore.
but i try at other server, the NFS filesystem is work properly
any idea on this?
# mount -p
/dev/md/dsk/d0 - / ufs - no... (1 Reply)
Discussion started by: SmartAntz
1 Replies
5. UNIX for Advanced & Expert Users
There was an update in sudo 1.7.5 :
-The I/O log directory may now be specified in the sudoers file.
I am stuck using sudo 1.7.4p6. Because it is supported by HP on thier HP-UX builds.
Is there a process to change this directory in sudo 1.7.4p6?
currently sudo 1.7.4p6's default is... (3 Replies)
Discussion started by: trimike
3 Replies
6. AIX
My AIX NFS client failed to mount a Windows server NFS service today.
Is NFS client logging enabled by default on AIX? If not, is there a way to enable NFS client logging on AIX6.1.
Thanks. (0 Replies)
Discussion started by: famasutika
0 Replies
7. Solaris
Hi All
I have a requirement in which during sudo logging, I must get the year details also in sudo log file. As below output is not mentioning the year due to this I will not able to idenfiy that this log belong to 2012 or 2011 or 2010
Dec 12 11:30:21 XYZ sudo: user1 : TTY=pts/5 ;... (4 Replies)
Discussion started by: sb200
4 Replies
8. Shell Programming and Scripting
Hello all,
i wrote a shell script that was running perfectly fine until we had some issue with our NFS server and the script was hung.
This script runs every 20 mins and obviously as we had the NFS issue, the script start to hang. as i do a check to make sure
NFS directory is avaiable or not.... (7 Replies)
Discussion started by: crazy_max
7 Replies
9. HP-UX
Hi.
I'm having problems with my HP C8000 and 11.11 (ifs client needs to be restarted every week), trying to get it worked out.
When I searched the web it seems, I require the following patches:
PHKL_41041, PHKL_43823, PHKL_43577
Is there anyway to get hold of these packages?
Many thanks... (2 Replies)
Discussion started by: plantage
2 Replies
10. AIX
Been trying to get a directory NFS-mounted with no success. I've tried both NFS v3 and v4, but currently trying v4. I can't figure out what's going on here.
server: sbkovwadmd01
sbkovwadmd01# chnfsdom
Current local domain: edw.dev
sbkovwadmd01# lssrc -a | grep nfs | grep active
nfsd ... (3 Replies)
Discussion started by: eckertd
3 Replies
LEARN ABOUT CENTOS
pam_ssh_agent_auth
pam_ssh_agent_auth(8) PAM pam_ssh_agent_auth(8)
PAM_SSH_AGENT_AUTH
This module provides authentication via ssh-agent. If an ssh-agent listening at SSH_AUTH_SOCK can successfully authenticate that it has
the secret key for a public key in the specified file, authentication is granted, otherwise authentication fails.
SUMMARY
/etc/pam.d/sudo: auth sufficient pam_ssh_agent_auth.so file=/etc/security/authorized_keys
/etc/sudoers:
Defaults env_keep += "SSH_AUTH_SOCK"
This configuration would permit anyone who has an SSH_AUTH_SOCK that manages the private key matching a public key in
/etc/security/authorized_keys to execute sudo without having to enter a password. Note that the ssh-agent listening to SSH_AUTH_SOCK can
either be local, or forwarded.
Unlike NOPASSWD, this still requires an authentication, it's just that the authentication is provided by ssh-agent, and not password entry.
ARGUMENTS
file=<path to authorized_keys>
Specify the path to the authorized_keys file(s) you would like to use for authentication. Subject to tilde and % EXPANSIONS (below)
allow_user_owned_authorized_keys_file
A flag which enables authorized_keys files to be owned by the invoking user, instead of root. This flag is enabled automatically
whenever the expansions %h or ~ are used.
debug
A flag which enables verbose logging
sudo_service_name=<service name you compiled sudo to use>
(when compiled with --enable-sudo-hack)
Specify the service name to use to identify the service "sudo". When the PAM_SERVICE identifier matches this string, and if PAM_RUSER
is not set, pam_ssh_agent_auth will attempt to identify the calling user from the environment variable SUDO_USER.
This defaults to "sudo".
EXPANSIONS
~ -- same as in shells, a user's Home directory
Automatically enables allow_user_owned_authorized_keys_file if used in the context of ~/. If used as ~user/, it would expect the file
to be owned by 'user', unless you explicitely set allow_user_owned_authorized_keys_file
%h -- User's Home directory
Automatically enables allow_user_owned_authorized_keys_file
%H -- The short-hostname
%u -- Username
%f -- FQDN
EXAMPLES
in /etc/pam.d/sudo
"auth sufficient pam_ssh_agent_auth.so file=~/.ssh/authorized_keys"
The default .ssh/authorized_keys file in a user's home-directory
"auth sufficient pam_ssh_agent_auth.so file=%h/.ssh/authorized_keys"
Same as above.
"auth sufficient pam_ssh_agent_auth.so file=~fred/.ssh/authorized_keys"
If the home-directory of user 'fred' was /home/fred, this would expand to /home/fred/.ssh/authorized_keys. In this case, we have not
specified allow_user_owned_authorized_keys_file, so this file must be owned by 'fred'.
"auth sufficient pam_ssh_agent_auth.so file=/secure/%H/%u/authorized_keys allow_user_owned_authorized_keys_file"
On a host named foobar.baz.com, and a user named fred, would expand to /secure/foobar/fred/authorized_keys. In this case, we specified
allow_user_owned_authorized_keys_file, so fred would be able to manage that authorized_keys file himself.
"auth sufficient pam_ssh_agent_auth.so file=/secure/%f/%u/authorized_keys"
On a host named foobar.baz.com, and a user named fred, would expand to /secure/foobar.baz.com/fred/authorized_keys. In this case, we
have not specified allow_user_owned_authorized_keys_file, so this file must be owned by root.
v0.8 2009-08-09 pam_ssh_agent_auth(8)