I'm adding some Fedora 20 workstations to our Windows 2003 domain. I've successfully joined the domain with the boxes, and can login with domain accounts.
Now I'm trying to allow the default AD group
Enterprise Admins to use
SUDO, however whatever I do, it seems that the group cannot be found (or at least it tells me my user account is not in the sudoers file)
Structure of the OU (default really):
- DOmain Controllers
sssd to join the domain, and am trying to allow sudo to groups located under the
Users OU, but would also like to add some from the
CompanyName --> Admins OU/Sub-group as well.
I'm currently trying this with no luck (in /etc/sudoers)
%MYDOMAIN\\Enterprise^Admins ALL=(ALL) ALL
I've also tried variations as well, such as:
%MYDOMAIN\\Users\Enterprise^Admins ALL=(ALL) ALL %Enterprise^Admins@mydomain.local ALL=(ALL) ALL
etc... nothing seems to be working. Even after reboots, and/or
systemctrl restart sssd.
If i explicitly add my domain account to the /etc/sudoers file, it works no problem.
firstname.lastname@example.org ALL=(ALL) ALL
There are a few resources that seem to indicate it should be possible to add AD groups to sudoers, however so far none of them have worked for me: