sudo when authentication is ldap

[RedLetter]

I am just wondering if anyone else has had a challenge with sudo on hpux 11.0 when user authentication is via ldap.

sudoers file looks like
Host_Alias BLAHOST=ALL
User_Alias BLAUSER=user1,user2,user3
Cmnd_Alias BLACMD=ALL

BLAUSER BLAHOST=(root)NOPASSWD: BlACMD

Above requires the defined user to put in a password, but cannot find an how to validate the user. If I put the string at the bottom of th sudoers file that looks like:
user1 ALL=(root) NOPASSWD: BLACMD

user1 can do sudo

syslog sudo error message:

May 21 19:21:56 blahost sudo: user1 : 3 incorrect password attempts ; TTY=pts/
tc ; PWD=/tmp ; USER=root ; COMMAND=/usr/bin/vi /tmp/foo.sudo

we push the same sudoers file out to all our hp servers, the servers using NIS work fine. We converted two of the servers to LDAP this morning, and this issue was unexpected. Any ideas would be appreciated.
Thanks,

[RedLetter]

I forgot to add:
Sudo version 1.6.2p2
HPUX 11.0

[RedLetter]

I noticed that I had a typo.. note, above sudoers file is only an example.

BLAUSER BLAHOST=(root)NOPASSWD: BLACMD


Again, ideas would be a great help..
Thanks,

[Ermin Borovac · Accepted solution]

You'll need to re-compile sudo with --with-pam configure option.

You can even store sudoers file in LDAP if you compile with --with-ldap. See README.LDAP included with sudo source distribution.

[Bruce Fowler]

Hello Ermin,

Regarding your response that it will be necessary to recompile sudo with --pam, have you had any experience/success with that?

Thanks,

Bruce Fowler

[Sanjay_6]

Hi,

Did you try ldap in the password authentication methods in /etc/nsswitch.conf

passwd : files ldap

Hope this helps.

Regds

[RedLetter]

Thanks for everyones help. I recompiled sudo v1.6.8p8 with various config options. I had to spend a little time at
http://www.sudo.ws/ to get all the info and source I needed. So far my tests have been successful. I am not sure that I want to even see the "Goon" insults.. Thanks again..

[RedLetter]

Recompiled sudo v.1.6.8p8 with --ldap and --pam