![sudo 和 sssd 不适用于用户组](https://linux22.com/image/59515/sudo%20%E5%92%8C%20sssd%20%E4%B8%8D%E9%80%82%E7%94%A8%E4%BA%8E%E7%94%A8%E6%88%B7%E7%BB%84.png)
当我们使用 ldap 存储具有不同 sudo 特权的组时,与 sssd 集成的 sudo 无法正常工作。如果我们将 sudo 设置为直接访问 ldap,则效果很好。
这是我们的场景。
在 ldap 中定义一个用户:waynea
Waynea 是 2 个团体的成员。 gcadmin 组允许他以 root 身份运行特定命令。另一个组 gcoracle 允许他作为本地(未在 ldap 中定义)用户 oracle 运行特定命令。
waynea@pgc501> id
uid=5091(waynea) gid=5000(mcsuser) groups=5000(mcsuser),5022(gcadmin),5024(gcoracle)
这是 2 个组的 ldap sudo 定义:
waynea@pgc501> ldapsearch -h pld101.foo.com -x "(cn=%gcadmin)"
# %gcadmin, SUDOers, foo.com
dn: cn=%gcadmin,ou=SUDOers,dc=foo,dc=com
cn: %gcadmin
objectClass: sudoRole
objectClass: top
sudoCommand: /usr/bin/id
sudoCommand: /bin/ps
sudoCommand: /u01/oracle/12.1.0/agent12c/agent_inst/bin/emctl
sudoHost: ALL
sudoUser: %gcadmin
sudoRunAs: ALL
waynea@pgc501> ldapsearch -h pld101.foo.com -x "(cn=%gcadmin)"
# %gcoracle, SUDOers, foo.com
dn: cn=%gcoracle,ou=SUDOers,dc=foo,dc=com
cn: %gcoracle
objectClass: sudoRole
objectClass: top
sudoCommand: /bin/sh
sudoCommand: /u01/oracle/12.1.0/agent12c/sbin/nmosudo *
sudoHost: ALL
sudoRunAs: oracle
sudoUser: %gcoracle
现在,当我们将 sudo 直接连接到 ldap 时。 IE /etc/nsswitch.conf 有这个:
sudoers: files ldap
我发出“sudo -ll”,我得到这个:
waynea@pgc501 > sudo -ll
Matching Defaults entries for waynea on this host:
requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL
PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES",
env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User waynea may run the following commands on this host:
RunAsUsers: oracle
Commands:
/bin/sh
/u01/oracle/12.1.0/agent12c/sbin/nmosudo *
RunAsUsers: root
Commands:
/usr/bin/id
/u01/oracle/12.1.0/agent12c/agent_inst/bin/emctl
一切都很好。
当我们将 sudo 切换为使用 sssd 时,
sudoers: files sss
我们得到这个:
waynea@pgc501 > sudo -ll
Matching Defaults entries for waynea on this host:
requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL
PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES",
env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User waynea may run the following commands on this host:
RunAsUsers: root
Commands:
/bin/sh
/u01/oracle/12.1.0/agent12c/sbin/nmosudo *
RunAsUsers: root
Commands:
/usr/bin/id
/u01/oracle/12.1.0/agent12c/agent_inst/bin/emctl
现在,waynea 获得了以 root 身份启动 shell (/bin/sh) 的权限。
以下是 /etc/sssd/sssd.conf 中的相关条目。
[domain/default]
id_provider = ldap
auth_provider = ldap
sudo_provider = ldap
ldap_sudo_search_base = ou=SUDOers,dc=foo,dc=com
ldap_uri = ldap://pld101.foo.com,ldap://pld301.foo.com/
ldap_search_base = dc=foo,dc=com
ldap_user_search_base = ou=People,dc=foo,dc=com
ldap_group_object_class = posixGroup
ldap_group_search_base = ou=Group,dc=foo,dc=com
ldap_group_name = cn
ldap_group_member = memberUid
ldap_id_use_start_tls = False
chpass_provider = ldap
cache_credentials = true
[sudo]
ldap_sudo_full_refresh_interval = 86400
ldap_sudo_smart_refresh_interval = 3600
任何帮助,将不胜感激!我们想利用 sssd,但这在某种程度上是一个阻碍。
这是操作系统/rpm 版本:
Linux 6.5 (OEL)
sssd-1.9.2-129.el6_5.4.x86_64
sudo-1.8.6p3-12.el6.x86_64
libsss_sudo-1.9.2-129.el6_5.4.x86_64
sssd-client-1.9.2-129.el6_5.4.x86_64
答案1
用户waynea
需要注销并重新登录
sudo -ll
像这样打印:
[WanJie@svr-master root]$ sudo -ll
Matching Defaults entries for WanJie on this host:
!visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION
LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, !visiblepw,
always_set_home, env_reset, requiretty
用户WanJie
可以在此主机上运行以下命令:
SSSD Role: %admin
RunAsUsers: ALL
Options: !authenticate
Commands:
/root/aaa.sh
SSSD Role: WanJie
RunAsUsers: ALL
Options: !authenticate
Commands:
/root/sudo.sh