topic Re: sudo when authentication is ldap in Operating System - HP-UX

sudo when authentication is ldap

RedLetter — Sat, 21 May 2005 19:39:04 GMT

I am just wondering if anyone else has had a challenge with sudo on hpux 11.0 when user authentication is via ldap.

sudoers file looks like
Host_Alias BLAHOST=ALL
User_Alias BLAUSER=user1,user2,user3
Cmnd_Alias BLACMD=ALL

BLAUSER BLAHOST=(root)NOPASSWD: BlACMD

Above requires the defined user to put in a password, but cannot find an how to validate the user. If I put the string at the bottom of th sudoers file that looks like:
user1 ALL=(root) NOPASSWD: BLACMD

user1 can do sudo

syslog sudo error message:

May 21 19:21:56 blahost sudo: user1 : 3 incorrect password attempts ; TTY=pts/
tc ; PWD=/tmp ; USER=root ; COMMAND=/usr/bin/vi /tmp/foo.sudo

we push the same sudoers file out to all our hp servers, the servers using NIS work fine. We converted two of the servers to LDAP this morning, and this issue was unexpected. Any ideas would be appreciated.
Thanks,

Re: sudo when authentication is ldap

RedLetter — Sat, 21 May 2005 19:43:13 GMT

I forgot to add:
Sudo version 1.6.2p2
HPUX 11.0

Re: sudo when authentication is ldap

RedLetter — Sat, 21 May 2005 19:59:57 GMT

I noticed that I had a typo.. note, above sudoers file is only an example.

BLAUSER BLAHOST=(root)NOPASSWD: BLACMD

Again, ideas would be a great help..
Thanks,

Re: sudo when authentication is ldap

Ermin Borovac — Sat, 21 May 2005 20:03:58 GMT

You'll need to re-compile sudo with --with-pam configure option.

You can even store sudoers file in LDAP if you compile with --with-ldap. See README.LDAP included with sudo source distribution.

Re: sudo when authentication is ldap

Bruce Fowler — Mon, 23 May 2005 10:45:19 GMT

Hello Ermin,

Regarding your response that it will be necessary to recompile sudo with --pam, have you had any experience/success with that?

Thanks,

Bruce Fowler

Re: sudo when authentication is ldap

Sanjay_6 — Mon, 23 May 2005 11:17:37 GMT

Hi,

Did you try ldap in the password authentication methods in /etc/nsswitch.conf

passwd : files ldap

Hope this helps.

Regds

Re: sudo when authentication is ldap

RedLetter — Mon, 23 May 2005 12:26:27 GMT

Thanks for everyones help. I recompiled sudo v1.6.8p8 with various config options. I had to spend a little time at
http://www.sudo.ws/ to get all the info and source I needed. So far my tests have been successful. I am not sure that I want to even see the "Goon" insults.. Thanks again..

Re: sudo when authentication is ldap

RedLetter — Mon, 23 May 2005 12:27:46 GMT

Recompiled sudo v.1.6.8p8 with --ldap and --pam