Hi all,
I'm in the process of testing IPA server for centralised
authentication of our linux hosts. We run CentOS 6.5 and it's all new so
we have no legacy issues.
In the lab I've set up an IPA server with the yum install and used a local
bind instance which all seems to be working correctly. Where the issues
begin is with the sudoers functionality. After reading the manual and
consulting Google sensei I found a number of resources that talk about
setting up ldap either natively in the nsswitch.conf file or via sssd,
I've tried a number of slightly different configurations on the client
side with little effect. So the question is "what is the process for
configuring an IPA system to handle sudo functionality".
Any help is greatly appreciated.
----------------------nssswitch.conf--------------------------------------
# /etc/nsswitch.conf
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
# Valid entries include:
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# db Use the local database (.db) files
# compat Use NIS on compat mode
# hesiod Use Hesiod for user lookups
# [NOTFOUND=return] Stop searching if not found so far
# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
# Example:
#passwd: db files nisplus nis
#shadow: db files nisplus nis
#group: db files nisplus nis
passwd: files sss
shadow: files sss
group: files sss
#hosts: db files nisplus nis dns
hosts: files dns
# Example - obey only what nisplus tells us...
#services: nisplus [NOTFOUND=return] files
#networks: nisplus [NOTFOUND=return] files
#protocols: nisplus [NOTFOUND=return] files
#rpc: nisplus [NOTFOUND=return] files
#ethers: nisplus [NOTFOUND=return] files
#netmasks: nisplus [NOTFOUND=return] files
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
sudoers: files sss
netgroup: files sss
publickey: nisplus
automount: files sss
aliases: files nisplus
I'm in the process of testing IPA server for centralised
authentication of our linux hosts. We run CentOS 6.5 and it's all new so
we have no legacy issues.
In the lab I've set up an IPA server with the yum install and used a local
bind instance which all seems to be working correctly. Where the issues
begin is with the sudoers functionality. After reading the manual and
consulting Google sensei I found a number of resources that talk about
setting up ldap either natively in the nsswitch.conf file or via sssd,
I've tried a number of slightly different configurations on the client
side with little effect. So the question is "what is the process for
configuring an IPA system to handle sudo functionality".
Any help is greatly appreciated.
----------------------nssswitch.conf--------------------------------------
# /etc/nsswitch.conf
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
# Valid entries include:
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# db Use the local database (.db) files
# compat Use NIS on compat mode
# hesiod Use Hesiod for user lookups
# [NOTFOUND=return] Stop searching if not found so far
# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
# Example:
#passwd: db files nisplus nis
#shadow: db files nisplus nis
#group: db files nisplus nis
passwd: files sss
shadow: files sss
group: files sss
#hosts: db files nisplus nis dns
hosts: files dns
# Example - obey only what nisplus tells us...
#services: nisplus [NOTFOUND=return] files
#networks: nisplus [NOTFOUND=return] files
#protocols: nisplus [NOTFOUND=return] files
#rpc: nisplus [NOTFOUND=return] files
#ethers: nisplus [NOTFOUND=return] files
#netmasks: nisplus [NOTFOUND=return] files
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
sudoers: files sss
netgroup: files sss
publickey: nisplus
automount: files sss
aliases: files nisplus