LDAP/sudo

[root@ldap-server ~]# cp /usr/share/doc/sudo/schema.OpenLDAP /tmp/sudo.schema
[root@ldap-server ~]# cd /tmp
[root@ldap-server tmp]# vi sudo.conf
include /etc/openldap/schema/core.schema
include /tmp/sudo.schema
 
[root@ldap-server tmp]# mkdir sample
 
[root@ldap-server tmp]# slaptest -f sudo.conf -F /tmp/sample/

[root@ldap-server tmp]# less "sample/cn=config/cn=schema/cn={1}sudo.ldif"
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 2e34f948
dn: cn={1}sudo
objectClass: olcSchemaConfig
cn: {1}sudo
olcAttributeTypes: {0}( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s)
 who may  run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMa
 tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: {1}( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s)
 who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMat
 ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: {2}( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Comma
 nd(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1
 466.115.121.1.26 )
olcAttributeTypes: {3}( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s)
  impersonated by sudo (deprecated)' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1
 .4.1.1466.115.121.1.26 )
olcAttributeTypes: {4}( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Option
 s(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115
 .121.1.26 )
olcAttributeTypes: {5}( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'Use
 r(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466
 .115.121.1.26 )
olcAttributeTypes: {6}( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Gr
 oup(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.14
 66.115.121.1.26 )
olcAttributeTypes: {7}( 1.3.6.1.4.1.15953.9.1.8 NAME 'sudoNotBefore' DESC 'Sta
 rt of time interval for which the entry is valid' EQUALITY generalizedTimeMat
 ch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
  )
olcAttributeTypes: {8}( 1.3.6.1.4.1.15953.9.1.9 NAME 'sudoNotAfter' DESC 'End
 of time interval for which the entry is valid' EQUALITY generalizedTimeMatch
 ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
olcAttributeTypes: {9}( 1.3.6.1.4.1.15953.9.1.10 NAME 'sudoOrder' DESC 'an int
 eger to order the sudoRole entries' EQUALITY integerMatch ORDERING integerOrd
 eringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
olcObjectClasses: {0}( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' DESC 'Sudoer En
 tries' SUP top STRUCTURAL MUST cn MAY ( sudoUser $ sudoHost $ sudoCommand $ s
 udoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoOrder $ sudoNotB
 efore $ sudoNotAfter $ description ) )
structuralObjectClass: olcSchemaConfig
entryUUID: 3449bc7a-62f5-103e-85ef-9d193e8981ea
creatorsName: cn=config
createTimestamp: 20240218220251Z
entryCSN: 20240218220251.480716Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20240218220251Z
 
[root@ldap-server tmp]#

[root@ldap-server tmp]# cp "sample/cn=config/cn=schema/cn={1}sudo.ldif" ~/ldap/sudo.ldif
[root@ldap-server tmp]# cd
[root@ldap-server ~]# vi ldap/sudo.ldif

wget http://netbsd.ftp.fu-berlin.de/pub/NetBSD/pkgsrc/packages/NetBSD/amd64/9.3/All/openldap-extra-schemas-4.3.tgz
tar xf openldap-extra-schemas-4.3.tgz share/examples/openldap/schema/
ls -l share/examples/openldap/schema/sudo.ldif

[root@ldap-server ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f ldap/sudo.ldif
 
(確認)
[root@ldap-server ~]# ldapsearch -x -LLL -W -D cn=config -b cn=config dn
 :
dn: cn={4}sudo,cn=schema,cn=config
 :
[root@ldap-server ~]#

[root@ldap-server ~]# vi ldap/sudoers.ldif
dn: ou=sudoers,dc=sybyl,dc=local
objectClass: organizationalUnit
ou: sudoers
 
dn: cn=supervisor,ou=sudoers,dc=sybyl,dc=local
objectClass: top
objectClass: sudorole
cn: supervisor
sudoUser: %supervisor    <-- ldapで作っているアカウントでグループが「supervisor」に所属するならsudoできるよ
sudoCommand: ALL
sudoHost: ALL
 
[root@ldap-server ~]# ldapadd -x -D cn=Manager,dc=sybyl,dc=local -W -f ldap/sudoers.ldif

[root@ldap-client ~]# ls /usr/lib64/libnss*
/usr/lib64/libnss3.so          /usr/lib64/libnss_dns.so.2         /usr/lib64/libnss_resolve.so.2  /usr/lib64/libnss_systemd.so.2
/usr/lib64/libnssckbi.so       /usr/lib64/libnss_files.so.2       /usr/lib64/libnss_sss.so.2      /usr/lib64/libnssutil3.so
/usr/lib64/libnss_compat.so.2  /usr/lib64/libnss_myhostname.so.2  /usr/lib64/libnsssysinit.so
[root@ldap-client ~]#

[root@ldap-client ~]# vi /etc/sssd/sssd.conf
[sssd]
services = nss, pam, sudo   <-- sudoを追加
domains = default
 
[sudo]                      <-- [sudo]を追加
 
[nss]
 
[domain/default]
id_provider = ldap
ldap_uri = ldaps://ldap-server/
ldap_search_base = dc=sybyl,dc=local
ldap_id_use_start_tls = True
ldap_tls_reqcert = never
ldap_default_bind_dn = cn=access,ou=People,dc=sybyl,dc=local
ldap_default_authtok = AAAQAKooYshlPbF2vEJmZVGj51mmVV25TUrl5je4（略
access_provider = permit
sudo_provider = ldap
auth_provider = ldap
autofs_provider = ldap
resolver_provider = ldap
ldap_default_authtok_type = obfuscated_password
ldap_sudo_search_base = ou=sudoers,dc=sybyl,dc=local    <--- 追加
 
[root@ldap-client ~]#

[root@ldap-client ~]# authselect list-features sssd
with-custom-automount
with-custom-group
with-custom-netgroup
with-custom-passwd
with-custom-services
with-faillock
with-files-access-provider
with-files-domain
with-fingerprint
with-gssapi
with-mkhomedir
with-pam-gnome-keyring
with-pam-u2f
with-pam-u2f-2fa
with-pamaccess
with-pwhistory
with-silent-lastlog
with-smartcard
with-smartcard-lock-on-removal
with-smartcard-required
with-subid
with-sudo
without-nullok
without-pam-u2f-nouserok
 
[root@ldap-client ~]# authselect select sssd with-mkhomedir with-sudo --force

[root@ldap-client ~]# less /etc/nsswitch.conf
 :
sudoers:    files sss
 :
[root@ldap-client ~]#

[root@ldap-client ~]# systemctl restart sssd