Chapter 8. Authenticating to sudo remotely using smart cards

Procedure

1. Create a sudo rule named adminrule to allow a user to run commands.

   ipa sudorule-add adminrule

2. Add less and whoami as sudo commands:

   ipa sudocmd-add /usr/bin/less
   ipa sudocmd-add /usr/bin/whoami

3. Add the less and whoami commands to the adminrule:

   ipa sudorule-add-allow-command adminrule --sudocmds /usr/bin/less
   ipa sudorule-add-allow-command adminrule --sudocmds /usr/bin/whoami

4. Add the ipauser1 user to the adminrule:

   ipa sudorule-add-user adminrule --users ipauser1

5. Add the host on which you are running sudo to the adminrule:

   ipa sudorule-add-host adminrule --hosts server.ipa.test

Procedure

1. Install the PAM SSH agent:

   dnf -y install pam_ssh_agent_auth

2. Add the authorized_keys_command for pam_ssh_agent_auth.so to the /etc/pam.d/sudo file before any other auth entry:

   #%PAM-1.0
   auth sufficient pam_ssh_agent_auth.so authorized_keys_command=/usr/bin/sss_ssh_authorizedkeys
   auth       include      system-auth
   account    include      system-auth
   password   include      system-auth
   session    include      system-auth

3. To enable the SSH agent forwarding to work when you run sudo commands, add the following to the /etc/sudoers file:

   Defaults env_keep += "SSH_AUTH_SOCK"

   This allows users who have their public keys from smart cards stored in IPA/SSSD to authenticate to sudo without entering a password.

4. Restart the sssd service:

   systemctl restart sssd

Procedure

1. Start the SSH agent (if not already running).

   eval `ssh-agent`

2. Add your smart card to the SSH agent. Enter your PIN when prompted:

   ssh-add -s /usr/lib64/opensc-pkcs11.so

3. Connect to the system where you need to run sudo remotely by using SSH with ssh-agent forwarding enabled. Use the -A option:

   ssh -A ipauser1@server.ipa.test