Red Hat Bugzilla – Bug 1080209
IPA server does not allow sudo host network filters
Last modified: 2015-03-05 05:10:41 EST
Description of problem: Attempting to set a subnet in an external host filter for a sudo rule fails with "IPA Error 3009". Version-Release number of selected component (if applicable): ipa-server-3.0.0-26.el6_4.2.x86_64 Steps to Reproduce: 1. Create a sudo rule 2. Add "10.0.0.0/8" as an external host. 3. Actual results: IPA Error 3009 invalid 'host': only letters, numbers, _, and - are allowed. DNS label may not start or end with - Expected results: success Additional info: The sudoers man page defines a host filter as: Host ::= '!'* host name | '!'* ip_addr | '!'* network(/netmask)? | '!'* +netgroup | '!'* Host_Alias The sudoers.ldap man page even says the 'sudoHost' LDAP attribute supports "IP network". Thus "10.0.0.0/8" should be accepted as a valid host filter.
This looks like another gap in our sudo compat tree generation code. See also Bug 1066572. I will open upstream ticket.
Upstream ticket: https://fedorahosted.org/freeipa/ticket/4274
Fixed upstream as part of sudorule enhancements master: https://fedorahosted.org/freeipa/changeset/5a1207cb6ee6dd4314ae95e6637ee6859d5fda1a https://fedorahosted.org/freeipa/changeset/a228d7a3cb32b14ff24b47adb14d896d317f6312 (fixes this bug) https://fedorahosted.org/freeipa/changeset/9304b649a32c57e80f53913d7fbdee92fd76a251 https://fedorahosted.org/freeipa/changeset/3a56b155e80a744c7a924915aae954e0a3d81e9e https://fedorahosted.org/freeipa/changeset/c7da22c1e69cb4d6cc8c6f368aad5ffddbd3762c https://fedorahosted.org/freeipa/changeset/af2eb4d69506b641504d076e79b80c7ee54eeda9 https://fedorahosted.org/freeipa/changeset/9bb88a15e0297e3a3e8e713267bc399164e0cdd6 https://fedorahosted.org/freeipa/changeset/a1d6c9ab6b710076902c1dd8ffcdec96b2538c21 https://fedorahosted.org/freeipa/changeset/b1275c5b1c2038c9769377e9cf0afe04139d1d8d https://fedorahosted.org/freeipa/changeset/d537da8b8a52dde18f4d07455fef8a4ef1c4ef04 https://fedorahosted.org/freeipa/changeset/c50d190549ff56c35d2dac270f319d764c972113 https://fedorahosted.org/freeipa/changeset/ec2050b7dfa94ef5ce41172a98c9153c14d4c972 https://fedorahosted.org/freeipa/changeset/e0fd2695ca3c1c2df8bbecadd4597ccf0aeca004 https://fedorahosted.org/freeipa/changeset/701f1fc8ba8fa2cbde6c16b031793d0069fddd33 https://fedorahosted.org/freeipa/changeset/e7969f5af56be1b9163a8f9ee4686becb3fdcb59 https://fedorahosted.org/freeipa/changeset/af4518b72882f88a01de0e5c23d423898ba894b4
Verified. Version :: ipa-server-4.1.0-16.el7.x86_64 Results :: [root@rhel7-1 sssd]# ipa help sudorule-add-host Usage: ipa [global-options] sudorule-add-host SUDORULE-NAME [options] Add hosts and hostgroups affected by Sudo Rule. Options: -h, --help show this help message and exit --all Retrieve and print all attributes from the server. Affects command output. --raw Print entries as stored on the server. Only affects output format. --hosts=STR hosts to add --hostgroups=STR host groups to add --hostmask=STR host masks of allowed hosts [root@rhel7-1 sssd]# ipa sudorule-add-host test --hostmask='10.0.0.0/8' --hosts='' Rule name: test Enabled: TRUE Host Masks: 10.0.0.0/8 ------------------------- Number of members added 1 ------------------------- FYI, needed --hosts='' for avoiding interactive mode asking for host.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0442.html