1

I work for an organization with many linux servers that we'd like to start authenticating with Active Directory. I have a proof-of-concept server set up on which I use SSSD and Kerberos to authenticate with Active Directory. Currently, I have it set up so that only users from a certain group (we'll call it group-A) can log into the server, and this is working properly. Next, I set about making it so that users from another group (group-B) automatically have sudo permissions. Here's the structure of the organizational units in our Active Directory:

group-A

Group-A structure

group-B

Group-B Structure

I can successfully log in as an active directory user, and I have included my sssd.conf below:

[sssd]
services = nss, pam
config_file_version = 2
domains = <organization>.LOCAL

[domain/<organization>.LOCAL]
id_provider = ad
access_provider = ad

# Use this if users are being logged in at /.
# This example specifies /home/DOMAIN-FQDN/user as /root.  Use with pam_mkhomedir.so
override_homedir = /home/%d/%u

# makes all users use bash as the default shell
override_shell = /bin/bash

# only allows users from the following groups to log in
ad_access_filter = (|(memberOf=cn=group-A,ou=Groups,ou=department,dc=organization,dc=local))

In order to allow all members of group-B sudo rights, I created a file named group-B-admin-group in /etc/sudoers.d that has the following content:

%group-B    ALL=(ALL)   ALL

at this point, I could not use sudo even with users who were in group-B. Executing sudo su would immediately require the password, and then report that the user was not in the sudoers file. Executing sudo touch this, sudo cat, sudo vim, and other such commands would require me to wait ~60s before asking me for my password. Upon entering my password, sudo reported that I was not in the sudoers file. At this point, I renamed the file /etc/sudoers.d/group-B-admin-group to /etc/sudoers.d/group-B and suddenly everything works fine. Users in group-B are immediately presented with a prompt for their password and then run the program with elevated privelages.

My question is this: I thought that the name of the file was moot (you can put permissions for multiple users/groups in one file, anyways.) Is part of my configuration requiring the name of the group and file to be the same? I just want to understand why this is behaving the way it does

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.