Chapter 8. Authenticating to sudo remotely using smart cards

Procedure

1. Create a sudo rule named <sudorule_name> to allow a user to run commands. Replace <sudorule_name> with the actual name of the sudo rule you want to create.

   Copy to Clipboard Toggle word wrap

   # ipa sudorule-add <sudorule_name>

2. Add less and whoami as sudo commands:

   Copy to Clipboard Toggle word wrap

   # ipa sudocmd-add /usr/bin/less
   # ipa sudocmd-add /usr/bin/whoami

3. Add the less and whoami commands to the <sudorule_name>:

   Copy to Clipboard Toggle word wrap

   # ipa sudorule-add-allow-command <sudorule_name> --sudocmds /usr/bin/less
   # ipa sudorule-add-allow-command <sudorule_name> --sudocmds /usr/bin/whoami

4. Add the <idm_user> user to the <sudorule_name>:

   Copy to Clipboard Toggle word wrap

   # ipa sudorule-add-user <sudorule_name> --users <idm_user>

5. Add the host on which you are running sudo to the <sudorule_name>:

   Copy to Clipboard Toggle word wrap

   # ipa sudorule-add-host <sudorule_name> --hosts server.ipa.test

Procedure

1. Install the PAM SSH agent:

   Copy to Clipboard Toggle word wrap

   # dnf -y install pam_ssh_agent_auth

2. Add the authorized_keys_command for pam_ssh_agent_auth.so to the /etc/pam.d/sudo file before any other auth entry:

   Copy to Clipboard Toggle word wrap

   #%PAM-1.0
   auth sufficient pam_ssh_agent_auth.so authorized_keys_command=/usr/bin/sss_ssh_authorizedkeys
   auth       include      system-auth
   account    include      system-auth
   password   include      system-auth
   session    include      system-auth

3. To enable the SSH agent forwarding to work when you run sudo commands, add the following to the /etc/sudoers file:

   Copy to Clipboard Toggle word wrap

   Defaults env_keep += "SSH_AUTH_SOCK"

   This allows users who have their public keys from smart cards stored in IPA/SSSD to authenticate to sudo without entering a password.

4. Restart the sssd service:

   Copy to Clipboard Toggle word wrap

   # systemctl restart sssd

Procedure

1. Start the SSH agent (if not already running).

   Copy to Clipboard Toggle word wrap

   # eval `ssh-agent`

2. Add your smart card to the SSH agent. Enter your PIN when prompted:

   Copy to Clipboard Toggle word wrap

   # ssh-add -s /usr/lib64/opensc-pkcs11.so

3. Connect to the system where you need to run sudo remotely by using SSH with ssh-agent forwarding enabled. Use the -A option:

   Copy to Clipboard Toggle word wrap

   # ssh -A ipauser1@server.ipa.test