One of the features of IPA is its facility to centrally manage sudoers rules. This rules can be based on user, group memberships etc. and be constrained to one or more servers.
One of the benefits you get is: You are able to define stricter sudoers rules without annoying the users. At the end your systems are more secure and more convenient for the users.
Unfortunately, sudoers via LDAP does not just work out of the box, some configuration on the clients needs to be done. Those can be equal on all hosts and distributed via configuration management such as puppet or RHN Satellite.
IPA has a user called “sudo”. We first need to set a password for it:
[root@ipa1 ~]# ldappasswd -x -S -W -h ipa1.example.com -ZZ -D "cn=Directory Manager" uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com New password: Re-enter new password: Enter LDAP Password: [root@ipa1 ~]#
We need to set this password later on as the bind password in the LDAP configuration.
Next we need to edit the /etc/nsswitch.conf file:
[root@ipaclient1 ~]# echo sudoers: files ldap >> /etc/nsswitch.conf
Lets configure the sudoers-ldap file
root@ipaclient1 ~]# cat << EOF > /etc/sudo-ldap.conf binddn uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com bindpw redhat ssl start_tls tls_cacertfile /etc/ipa/ca.crt tls_checkpeer yes uri ldap://ipa1.example.com ldap://ipa2.example.com sudoers_base ou=SUDOers,dc=example,dc=com EOF root@ipaclient1 ~]#
The bindpw (in this example “redhat” is that one you previously set with ldappasswd, change it accordingly. The paramter “uri” should contain two IPA servers (as FQDN, no IP Address or shortname) for redundancy. The “binddn” and “sudoers_base” of course should match your environment.
Remember netgroups? Old school stuff from the time when NIS was used. I thought I’ll never get in touch with NIS anymore. Unfortunately sudo uses netgroups, so we need to set a proper NIS domainname.
cat << EOF >> /etc/rc.d/rc.local nisdomainname example.com EOF
The following files are needed to be configured on each host using IPA for sudoers rules:
Expect part two of this in the next few days.
Have fun 🙂