Chapter 30. Using sudo
Identity Management provides a mechanism for predictably and consistently applying
sudo policies across the IdM domain. Every system in the IdM domain can be configured as a sudo client.
30.1. The sudo Utility in Identity Management
The
sudo utility gives administrative access to specified users. When trusted users precede an administrative command with sudo, they are prompted for their own password. Then, when they have been authenticated and assuming that the command is permitted, the administrative command is executed as if they were the root user. For more information about sudo, see the System Administrator's Guide.
30.1.1. The Identity Management LDAP Schema for sudo
IdM has a specialized LDAP schema for
sudo entries. The schema supports:
- Host groups as well as netgroups. Note that
sudoonly supports netgroups. sudocommand groups, which contain multiple commands.
Note
Because
sudo does not support host groups or command groups, IdM translates the IdM sudo configuration into the native sudo configuration when the sudo rules are created. For example, IdM creates a corresponding shadow netgroup for every host group, which allows the IdM administrator to create sudo rules that reference host groups, while the local sudo command uses the corresponding netgroup.
By default, the
sudo information is not available anonymously over LDAP. Therefore, IdM defines a default sudo user at uid=sudo,cn=sysaccounts,cn=etc,$SUFFIX. You can change this user in the LDAP sudo configuration file at /etc/sudo-ldap.conf.
30.1.2. NIS Domain Name Requirements
The NIS domain name must be set for netgroups and
sudo to work properly. The sudo configuration requires NIS-formatted netgroups and a NIS domain name for netgroups. However, IdM does not require the NIS domain to actually exist. It is also not required to have a NIS server installed.
Note
The
ipa-client-install utility sets a NIS domain name automatically to the IdM domain name by default.
