I configured sudoers ldap (with openldap as backend LDAP) using the instruction provided from the official sudoers website. (link)

Also restricted /etc/sudo-ldap.conf with 600 root:root permissions so that the normal users in the machine won't be able to know the LDAP server to which they are talking.

But the ldap server at the moment allow anonymous access connections to everything including sudoers OU. Is it possible in anyway to restrict the sudoers OU (say ou=sudoers,dc=example,dc=com) on the ldap server to a specific user and keep rest of the ldap structure for anonymous access ? (I couldn't figure out a proper way to do with access control)

Configuration details:


access to dn.subtree="dc=example,dc=com"
        by * read


uri ldap://LDAP_SERVER
sudoers_base ou=sudoers,dc=example,dc=com

Let me know if you need further details.

1 Answer 1


I figured out the right approach:

  • Create a new user in LDAP say cn=sudoread,dc=example,dc=com
cat > /tmp/tmplif <<EOF
dn: cn=sudoread,dc=example,dc=com
objectClass: top
objectClass: person
cn: sudoread
sn: read
userPassword: sudoread
$ ldapadd -H ldap://localhost -f /tmp/tmplif -D 'cn=root,dc=example,dc=com' -W
$ printf "sudoread" | base64

  • Grant access to ou=sudoers,dc=example,dc=com for the above created user before granting all access.
access to dn.one="ou=sudoers,dc=example,dc=com"
        by dn="cn=sudoread,dc=example,dc=com" read
access to *
        by * read
  • Use binddn and bindpw parameters in sudo-ldap.conf:
$ cat >> /etc/sudo-ldap.conf <<EOF
binddn cn=sudoread,dc=example,dc=com
bindpw base64:c3Vkb3JlYWQ=

This would create a user which can be used for querying the ldap and keeping the rest of the LDAP access to everything.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .