1

We have a LDAP server and lots working servers. Our user's info are in LDAP http://fclose.com/b/281/ . But sudoers list is stored in /etc/sudoers. Now the question is, how to store sudoers list in LDAP so that there is a center control of it?

We are using Fedora 12 on both LDAP server and working servers.

Improve this question

3 Answers 3

Reset to default
3

Follow the official instructions from README.LDAP, and the sudoers.ldap manual page.

  1. Make sure sudo is built with LDAP support.
  2. Update the LDAP schema.
  3. Import sudoers file into LDAP.
  4. Configure the sudoers service in nsswitch.conf.
Improve this answer
2
  • Are there any GUI based apps for managing Sudoer Rules in LDAP? Using a LDAP Browser is not a very user-friendly way for managing a large number of Sudo Rules. FreeIPA has a UI for managing Sudoer Rules, but it requires 389 Directory Server, and we don't use that in our environment (for good reasons)
    – Saqib Ali
    Oct 5, 2016 at 19:57
  • 2
    README.LDAP link is dead, so as sudoers.ldap link.
    – Dimitri Kopriwa
    Sep 8, 2018 at 0:26
3

Add sudo entry like below

dn: ou=sudoers,ou=people,dc=example,dc=com
ou: sudoers
objectClass: top
objectClass: organizationalUnit

dn: cn=sudogroup,ou=sudoers,ou=people,dc=example,dc=com
objectClass: top
objectClass: sudoRole
cn: sudogroup
sudoUser: thomas
sudoHost: ALL
sudoRunAs: ALL
sudoCommand: ALL

Add sudoers_base in ldap.conf for client.

sudoers_base ou=sudoers,ou=people,dc=example,dc=com

& Edit /etc/nsswitch.conf like below

sudoers : files ldap
Improve this answer
1
  • Do you have any reference we can rely on to understand that configuration?
    – Dimitri Kopriwa
    Sep 7, 2018 at 20:05
0

These instructions assume you're using OpenLDAP. Some details may be specific to Arch Linux.

  1. Make sure sudo is built with LDAP support. (see README.LDAP or this)
  2. Add the sudo schema to the LDAP server by editing slapd.conf to add include /etc/openldap/schema/sudo.schema. Note that this file must be copied from /usr/share/doc/sudo/schema.OpenLDAP (see README.LDAP).
  3. Per README.LDAP, direct the LDAP server to index the attribute sudoUser by adding the line index sudoUser eq to slapd.conf, and restart the LDAP server.

  4. Add the ou=SUDOers container to the database. This can be done by passing in the following via ldapadd:

    dn: ou=SUDOers,dc=example,dc=com
    objectClass: top
    objectClass: organizationalUnit
    ou: SUDOers

  5. Convert the existing sudoers file to LDIF format with cvtsudoers add it to the database with ldapadd (see README.LDAP). The configuration could, of course, be generated from scratch instead.

  6. Creat (or edit) ldap.conf (/etc/openldap/ldap.conf on Arch) on the client to add sudoers_base ou=SUDOers,dc=example,dc=com to make sudo LDAP-aware (see sudoers.ldap). Depending on your LDAP configuration, it may be necessary to set various LDAP options as well; sudo's syntax for setting options may be different than your LDAP implementation, so the same information may need to be provided twice.
  7. Edit sudoers service in nsswitch.conf to be sudoers: files ldap, or to sudoers: files sss if caching with SSSD (see sudoers.ldap manual). If caching w/ SSSD, the necessary entries will need to be added to sssd.conf (and on systems running systemd sssd-sudo.socket must be enabled (see manual page for SSSD-SUDO))
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .