Bug 1118336 – sudo: invalid sudoHost filter with asterisk

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1118336 - sudo: invalid sudoHost filter with asterisk

Summary:	sudo: invalid sudoHost filter with asterisk

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	sssd (Show other bugs)
Sub Component:
Version:	6.0
Hardware:	Unspecified Unspecified

Priority	unspecified Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Jakub Hrozek
QA Contact:	Kaushik Banerjee
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:	1118339
	Show dependency tree / graph

Reported:	2014-07-10 09:08 EDT by Dmitri Pal
Modified:	2014-10-14 00:48 EDT (History)
CC List:	9 users (show)

See Also:
Fixed In Version:	sssd-1.11.6-16.el6
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Clones:	1118339 (view as bug list)
Environment:
Last Closed:	2014-10-14 00:48:58 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2014:1375	normal	SHIPPED_LIVE	sssd bug fix and enhancement update	2014-10-13 21:06:25 EDT

Groups: None (edit)

Description Dmitri Pal 2014-07-10 09:08:04 EDT

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/2377


{{{
(sudoHost=*\**) should be replaced with (sudoHost=*\2A*)
}}}
 according to rfc http://tools.ietf.org/html/rfc4515, otherwise the filter is invalid.

Comment 1 Jakub Hrozek 2014-07-29 09:44:29 EDT

Fixed upstream:
    master:
        8c4abd227035169e75cb081424765e65c52b5266 
    sssd-1-11:
        552f9bc07d15c371090a5514bb1821a7e4505203

Comment 3 Nirupama Karandikar 2014-09-10 04:07:02 EDT

Hello,

Could you please provide steps to reproduce the issue.

Thanks,

Nirupama

Comment 4 Jakub Hrozek 2014-09-10 08:19:30 EDT

I would only perform regression testing for sudo. The servers we ship in RHEL didn't exhibit the issue.

Comment 5 Nirupama Karandikar 2014-09-11 04:48:49 EDT

Tested with sssd-1.11.6-29.el6.x86_64

1. Configure sssd with "sudo_provider = ldap". Restart sssd service.

2. From /var/log/sssd/sssd_LDAP.log

(Thu Sep 11 14:18:02 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=dhcp207-31.lab.eng.pnq.redhat.com)(sudoHost=dhcp207-31)(sudoHost=10.65.207.31)(sudoHost=10.65.206.0/23)(sudoHost=fe80::5054:ff:feec:c24a)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*\\*)(sudoHost=*?*)(sudoHost=*\2A*)(sudoHost=*[*]*))))][dc=example,dc=com].

The "(sudoHost=*\2A*)" with older version has "(sudoHost=*\**)" in the domain logs.

Comment 6 errata-xmlrpc 2014-10-14 00:48:58 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1375.html

Note You need to log in before you can comment on or make changes to this bug.