Bug 720711
| Summary: | Users are not matched from sudo client. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Gowrishankar Rajaiyan <grajaiya> |
| Component: | ipa | Assignee: | Rob Crittenden <rcritten> |
| Status: | CLOSED ERRATA | QA Contact: | Chandrasekar Kannan <ckannan> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.2 | CC: | benl, jgalipea, mkosek, shaines |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-2.1.0-1.el6 | Doc Type: | Bug Fix |
| Doc Text: |
Do not document
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-12-06 18:41:14 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Gowrishankar Rajaiyan
2011-07-12 15:06:15 UTC
Note: In this case ipa server was installed with --setup-dns option. ipa-server-install --setup-dns --forwarder=$DNSFORWARD --hostname=$hostname_s.$DOMAIN -r $RELM -n $DOMAIN -p $ADMINPW -P $ADMINPW -a $ADMINPW -U I installed ipa-server without this option and sudo seems to work as expected. Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/9869b0971d98457fce181c6de78c173e1b5ebff1 ipa-2-0: https://fedorahosted.org/freeipa/changeset/6404a98ab95b1ed558dcf900bc0788a49f31aae1
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
Do not document
-sh-4.1$ sudo -l > /tmp/sudo_list.out 2>&1
[sudo] password for user1:
-sh-4.1$ LDAP Config Summary
===================
uri ldap://qe-blade-12.testrelm
ldap_version 3
sudoers_base ou=SUDOers,dc=testrelm
binddn uid=sudo,cn=sysaccounts,cn=etc,dc=testrelm
bindpw bind123
bind_timelimit 5000
timelimit 15
ssl no
tls_checkpeer (yes)
tls_cacertfile /etc/ipa/ca.crt
tls_cacertdir /etc/ipa
===================
sudo: ldap_initialize(ld, ldap://qe-blade-12.testrelm)
sudo: ldap_set_option: debug -> 0
sudo: ldap_set_option: ldap_version -> 3
sudo: ldap_set_option: tls_checkpeer -> 1
sudo: ldap_set_option: tls_cacertfile -> /etc/ipa/ca.crt
sudo: ldap_set_option: tls_cacert -> /etc/ipa/ca.crt
sudo: ldap_set_option: tls_cacertdir -> /etc/ipa
sudo: ldap_set_option: timelimit -> 15
sudo: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT, 5)
sudo: ldap_sasl_bind_s() ok
sudo: no default options found in ou=SUDOers,dc=testrelm
sudo: ldap sudoHost 'qe-blade-12.testrelm' ... MATCH!
sudo: user_matches=1
sudo: host_matches=1
sudo: sudo_ldap_lookup(52)=0x02
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.
sudo: ldap search '(|(sudoUser=user1)(sudoUser=%user1)(sudoUser=%ipausers)(sudoUser=ALL))'
sudo: ldap sudoHost 'qe-blade-12.testrelm' ... MATCH!
sudo: ldap search 'sudoUser=+*'
User user1 may run the following commands on this host:
(root) /bin/mkdir
:: [ PASS ] :: Running 'sudo_list user1'
:: [ PASS ] :: File '/tmp/sudo_list.out' should contain 'sudo: user_matches=1'
:: [ PASS ] :: File '/tmp/sudo_list.out' should contain 'sudo: host_matches=1'
:: [ PASS ] :: File '/tmp/sudo_list.out' should contain 'sudo: ldap sudoHost 'qe-blade-12.testrelm' ... MATCH'
:: [ PASS ] :: File '/tmp/sudo_list.out' should contain 'User user1 may run the following commands on this host:'
:: [ PASS ] :: File '/tmp/sudo_list.out' should contain '(root) /bin/mkdir'
Verified.
Version: ipa-server-2.1.3-7.el6.x86_64
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1533.html |