This is for Ubuntu 12.04.5 LTS
I am trying to implement SSSD as a client and everything works all right BUT SUDO
I cannot see anything happening in the sssd_sudo.log file at all but the usual file refresh
Installed versions:
- sudo-ldap : Version: 1.8.3p1-1ubuntu3.7
- sssd: Version: 1.8.6-0ubuntu0.3
- nscd: Version: 2.15-0ubuntu10.11
- libsss-sudo: Version: 1.11.7-3
I can see in the logs sssd is searching within the sudoers in the ldap server. (note is is a freeIPA 4.1 ldap server and This implementation is using PLANE sssd so nothing ipa related in the ubuntu client box)
Configs:
nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
# passwd: compat sss
# pre_auth-client-config # passwd: compat
passwd: compat sss
# group: compat sss
# pre_auth-client-config # group: compat
group: compat sss
# shadow: compat
# pre_auth-client-config # shadow: compat
shadow: compat
hosts: files dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
sudoers: files sss
sudoers_debug: 1
# netgroup: nis sss
# pre_auth-client-config # netgroup: nis
netgroup: nis
sssd.conf
[sssd]
debug_level = 5
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
#services = nss, pam
services = nss,pam,sudo
domains = corp.company.com
[nss]
debug_level = 9
reconnection_retries = 3
entry_cache_nowait_percentage = 50
[pam]
debug_level = 9
reconnection_retries = 3
offline_failed_login_attempts = 5
offline_failed_login_delay = 5
[domain/corp.company.com]
ldap_tls_cacert = /etc/ldap/cacerts/389.crt
enumerate = True
#min_id = 200
debug_level = 5
ldap_tls_reqcert = demand
ldap_id_use_start_tls = True
cache_credentials = True
ldap_uri = ldaps://freeipa.server.com
#auth_provider = krb5
#chpass_provider = ldap
#krb5_realm = corp.company.com
auth_provider = ldap
id_provider = ldap
access_provider = simple
ldap_search_base = dc=corp,dc=company,dc=com
ldap_schema = rfc2307
ldap_user_search_base = cn=users,cn=accounts,dc=corp,dc=company,dc=com
ldap_group_search_base = cn=groups,cn=accounts,dc=corp,dc=company,dc=com
ldap_default_bind_dn = uid=specialuser,cn=users,cn=accounts,dc=corp,dc=company,dc=com
ldap_default_authtok_type = obfuscated_password
ldap_default_authtok = <password>
sudo_provider = ldap
ldap_sudo_search_base = ou=sudoers,DC=corp,DC=company,DC=com
[sudo]
debug_level = 9
log_files
sssd_sudo.log
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sss_process_init] (0x0020): Responder Initialization complete
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sudo_process_init] (0x0400): SUDO Initialization complete
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7BEB40
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7BEB40
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7C0FE0
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7C0FE0
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7bde20/0x7bb700 (13), R/- (disabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7bde20/0x7bb6b0 (13), -/W (enabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7c1570/0x7c0b60 (14), R/- (disabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7c1570/0x7c0b10 (14), -/W (enabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7bde20/0x7bb700 (13), R/- (enabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7bde20/0x7bb6b0 (13), -/W (disabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7c1570/0x7c0b60 (14), R/- (enabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7c1570/0x7c0b10 (14), -/W (disabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7bde20/0x7bb700 (13), R/- (disabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7bde20/0x7bb6b0 (13), -/W (enabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7c1570/0x7c0b60 (14), R/- (disabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7c1570/0x7c0b10 (14), -/W (enabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7bde20/0x7bb700 (13), R/- (enabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7bde20/0x7bb6b0 (13), -/W (disabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7c1570/0x7c0b60 (14), R/- (enabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_toggle_watch] (0x4000): 0x7c1570/0x7c0b10 (14), -/W (disabled)
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_remove_timeout] (0x2000): 0x7be830
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7BEB40
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): Dispatching.
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [id_callback] (0x0100): Got id ack and version (1) from Monitor
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_remove_timeout] (0x2000): 0x7c1a10
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7C0FE0
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): Dispatching.
(Thu Mar 26 20:47:26 2015) [sssd[sudo]] [dp_id_callback] (0x0100): Got id ack and version (1) from DP
(Thu Mar 26 20:47:36 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7BEB40
(Thu Mar 26 20:47:36 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): Dispatching.
(Thu Mar 26 20:47:36 2015) [sssd[sudo]] [sbus_message_handler] (0x4000): Received SBUS method [ping]
(Thu Mar 26 20:47:46 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7BEB40
(Thu Mar 26 20:47:46 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): Dispatching.
(Thu Mar 26 20:47:46 2015) [sssd[sudo]] [sbus_message_handler] (0x4000): Received SBUS method [ping]
(Thu Mar 26 20:47:56 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7BEB40
(Thu Mar 26 20:47:56 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): Dispatching.
(Thu Mar 26 20:47:56 2015) [sssd[sudo]] [sbus_message_handler] (0x4000): Received SBUS method [ping]
(Thu Mar 26 20:48:06 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7BEB40
(Thu Mar 26 20:48:06 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): Dispatching.
(Thu Mar 26 20:48:06 2015) [sssd[sudo]] [sbus_message_handler] (0x4000): Received SBUS method [ping]
(Thu Mar 26 20:48:16 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7BEB40
(Thu Mar 26 20:48:16 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): Dispatching.
(Thu Mar 26 20:48:16 2015) [sssd[sudo]] [sbus_message_handler] (0x4000): Received SBUS method [ping]
(Thu Mar 26 20:48:26 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7BEB40
(Thu Mar 26 20:48:26 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): Dispatching.
(Thu Mar 26 20:48:26 2015) [sssd[sudo]] [sbus_message_handler] (0x4000): Received SBUS method [ping]
(Thu Mar 26 20:48:36 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): dbus conn: 7BEB40
(Thu Mar 26 20:48:36 2015) [sssd[sudo]] [sbus_dispatch] (0x4000): Dispatching.
sudo_domain.log
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sssm_simple_access_init] (0x0020): No rules supplied for simple access provider. Access will be granted for all users.
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [load_backend_module] (0x0200): no module name found in confdb, using [ldap].
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [load_backend_module] (0x0200): no module name found in confdb, using [ldap].
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [common_parse_search_base] (0x0100): Search base added: [SUDO][ou=sudoers,DC=corp,DC=company,DC=com][SUBTREE][]
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_sudorule_object_class has value sudoRole
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_sudorule_name has value cn
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_sudorule_command has value sudoCommand
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_sudorule_host has value sudoHost
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_sudorule_user has value sudoUser
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_sudorule_option has value sudoOption
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_sudorule_runasuser has value sudoRunAsUser
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_sudorule_runasgroup has value sudoRunAsGroup
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_sudorule_notbefore has value sudoNotBefore
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_sudorule_notafter has value sudoNotAfter
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_sudorule_order has value sudoOrder
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [load_backend_module] (0x0200): no module name found in confdb, using [ldap].
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [ldap_get_autofs_options] (0x0200): Option ldap_autofs_search_base set to dc=corp,dc=company,dc=com
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [common_parse_search_base] (0x0100): Search base added: [AUTOFS][dc=corp,dc=company,dc=com][SUBTREE][]
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_autofs_map_object_class has value automountMap
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_autofs_map_name has value ou
(Thu Mar 26 21:03:50 2015) [sssd[be[corp.company.com]]] [sdap_get_map] (0x0200): Option ldap_autofs_entry_object_class has value automount
Best Answer
First, SSSD 1.8 is very old and not supported by upstream anymore. I hope this is a vendor-supported distribution.
About sudo, I didn't see a request coming from sudo in the sssd_sudo log. In this old version you had to manually install libsss_sudo IIRC, you might want to check if that's the case on ubuntu, too.
Finally, I don't understand why do you use id_provider=ldap with an IPA server and not id_provider=ipa (as set up by ipa-client-install). Your hand-crafted configuration is incorrect, at least the schema should not be set to rfc2307, your group memberships will not work as IPA uses a variant of the rfc2307bis schema. You should also not use enumerate=True for performance reasons.