0

My server is joined to AD domain, and I used SSSD and realm to do so. I can log fine to the server using SSH and my AD credentials. I wanted to allow my user to run sudo, so I added %MY_AD_GROUP ALL=(ALL) ALL to my /etc/sudoers. It won´t work. I then tried to add my domain like all of these:

%MY_DOMAIN\\MY_AD_GROUP ALL=(ALL) ALL
%MY_AD_GROUP@MY_DOMAIN ALL=(ALL) ALL
%:MY_AD_GROUP@MY_DOMAIN ALL=(ALL) ALL
+MY_AD_GROUP ALL=(ALL) ALL
+MY_DOMAIN\\MY_AD_GROUP ALL=(ALL) ALL
+MY_AD_GROUP@MY_DOMAIN ALL=(ALL) ALL

and none of them worked either. If I run id:

$ id
uid=1953620811(my_user) gid=1953600513(domain users) groups=1953600513(domain users) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

it shows my user is indeed an AD user.

Something worth mentioning: I first check a group I´m a member of in AD:

$ getent group MY_AD_GROUP
MY_AD_GROUP:*:1953654054:user1,my_user,user3,user4

so, my_user is a member of MY_AD_GROUP, then I add it to /etc/sudoers (via visudo) and try to run:

$ sudo echo a
[sudo] password for my_user:
my_user is not in the sudoers file.  This incident will be reported.

I then check again MY_AD_GROUP:

$ getent group MY_AD_GROUP
MY_AD_GROUP:*:1953654054:user1,user3,user4

and my user disappeared from the list (but I know it is still a member of the AD group). And, as soon as I run $ sss_cache -E and run:

$ getent group MY_AD_GROUP
MY_AD_GROUP:*:1953654054:user1,my_user,user3,user4

the user show up again, although sudo won´t work. So, what is going on???

  • I'm tempted to remove the sudo tag, since it seems (to me) that the core issue is that you're getting sporadic behavior with getent group MY_AD_GROUP. – Jeff Schaller Mar 1 at 15:06
  • @JeffSchaller it could be the case, since I´m under the impression the same is happening to SSH AllowGroups directive, although I have to confirm. – Adriano_epifas Mar 1 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.