http://pig.made-it.com/ldap-sudoers.html
https://www.lisenet.com/2015/convert-openldap-schema-to-ldif/
http://qiita.com/T_Tsan/items/5ea2563450ed2d2ee20f
http://edo.blog.jp/archives/1538669.html
服务端
yum -y install sudo
sudo-ldap方案
cp /usr/share/doc/sudo-1.8.6p7/schema.OpenLDAP /etc/openldap/schema/sudo.schema
生成sudo.ldif
echo 'include /etc/openldap/schema/sudo.schema' > /tmp/sudo.conf
mkdir /tmp/sudo
slaptest -f /tmp/sudo.conf -F /tmp/sudo
# vim /tmp/sudo/cn=config/cn=schema/cn={0}sudo.ldif
替换
dn: cn={0}sudo
objectClass: olcSchemaConfig
cn: {0}sudo
为
dn: cn=sudo,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: sudo
删除
structuralObjectClass: olcSchemaConfig
entryUUID: bd975dc0-1654-1036-9c97-c37d6a498779
creatorsName: cn=config
createTimestamp: 20160924034303Z
entryCSN: 20160924034303.121340Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20160924034303Z
cp /tmp/sudo/cn=config/cn=schema/cn={0}sudo.ldif /etc/openldap/schema/sudo.ldif
sudo功能生效
vim /etc/openldap/slapd.conf
添加
include /etc/openldap/schema/sudo.schema
rm -rf /etc/openldap/slapd.d/*
slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
chown -R ldap:ldap /etc/openldap/slapd.d
systemctl restart slapd
sudoer权限
sudoer.ldif
dn: ou=sudoer,dc=suntv,dc=tv
ou: sudoer
objectClass: top
objectClass: organizationalUnit
dn: cn=default,ou=sudoer,dc=suntv,dc=tv
objectClass: sudoRole
cn: defaults
sudoOption: requiretty
sudoOption: !visiblepw
sudoOption: always_set_home
sudoOption: env_reset
sudoOption: env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
sudoOption: env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
sudoOption: env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
sudoOption: env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
sudoOption: env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
sudoOption: secure_path = /sbin:/bin:/usr/sbin:/usr/bin
sudoOption: logfile = /var/log/sudo
sudoOption: %g01, %g02 !requiretty
dn: cn=%g01,ou=sudoer,dc=suntv,dc=tv
objectClass: sudoRole
cn: %g01
sudoUser: %g01
sudoHost: ALL
sudoRunAsUser: ALL
sudoOption: !authenticate
sudoCommand: ALL
sudoCommand: !/bin/su*
sudoCommand: !/usr/bin/vim /etc/sudoers*
sudoCommand: !/bin/vi /etc/sudoers*
sudoCommand: !/usr/sbin/visudo
sudoCommand: !/usr/sbin/adduser*
sudoCommand: !/usr/sbin/useradd*
sudoCommand: !/usr/sbin/userdel*
sudoCommand: !/usr/sbin/groupadd*
sudoCommand: !/usr/sbin/groupdel*
sudoCommand: !/bin/sh
sudoCommand: !/bin/bash
sudoCommand: !/usr/bin/login
# g01组用户禁用su,禁用变更sudo权限，禁用用户组的操作
dn: cn=%g02,ou=sudoer,dc=suntv,dc=tv
objectClass: sudoRole
cn: %g02
sudoUser: %g02
sudoHost: ALL
sudoRunAsUser: ALL
sudoOption: !authenticate
sudoCommand: ALL
sudoCommand: !/bin/su*
# g02组用户禁用'sudo su',
#
ldapdelete -x -W -H ldaps:/// -D cn=manager,dc=suntv,dc=tv ou=sudoer,dc=suntv,dc=tv -r
ldapadd -H ldaps:/// -W -x -D cn=manager,dc=suntv,dc=tv -f sudoer.ldif
客户端
/etc/sssd/sssd.conf
[sssd]
services = nss, pam, sudo, ssh # add
config_file_version = 2
domains = ldap
[domain/ldap]
debug_level = 9
cache_credentials = True
enumerate = false
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
sudo_provider = # add
ldap_uri = ldaps://master.local,ldaps://slave.local
ldap_search_base = dc=suntv,dc=tv
ldap_sudo_search_base = ou=Sudoer,dc=suntv,dc=tv # add
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/openldap/cacerts/ca.crt
ldap_tls_reqcert = never
ldap_id_use_start_tls = false
entry_cache_timeout = 600
ldap_network_timeout = 2
[nss]
homedir_substring = /home
entry_negative_timeout = 20
entry_cache_nowait_percentage = 50
filter_users = root
filter_groups = root
[pam]
[sudo]
[autofs]
[ssh]
[pac]
/etc/nsswitch.conf
sudoers: file sss
禁用su
vim /etc/pam.d/su
去除以下行的注释
auth required pam_wheel.so use_uid
测试
u01
id
uid=1001(u01) gid=2001(g01) groups=2001(g01)
sudo -l
Matching Defaults entries for u01 on this host:
requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS
_XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User u01 may run the following commands on this host:
(ALL) NOPASSWD: ALL, !/bin/su*, !/usr/bin/vim /etc/sudoers*, !/bin/vi /etc/sudoers*, !/usr/sbin/visudo, !/usr/sbin/adduser*, !/usr/sbin/useradd*, !/usr/sbin/userdel*, !/usr/sbin/groupadd*,
!/usr/sbin/groupdel*, !/bin/sh, !/bin/bash, !/usr/bin/login
u04
id
uid=1004(u04) gid=2002(g02) groups=2002(g02)
sudo -l
Matching Defaults entries for u04 on this host:
requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS
_XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User u04 may run the following commands on this host:
(ALL) NOPASSWD: ALL, !/bin/su*
