20.5. IdM 클라이언트에서 서비스 계정으로 명령을 실행하는 CLI에서 sudo 규칙 생성

프로세스

1. IdM 관리자로 Kerberos 티켓을 검색합니다.

   [root@idmclient ~]# kinit admin

2. sudo 명령의 IdM 데이터베이스에 /opt/ third-party-app/bin/report 명령을 추가합니다.

   [root@idmclient ~]# ipa sudocmd-add /opt/third-party-app/bin/report
   ----------------------------------------------------
   Added Sudo Command "/opt/third-party-app/bin/report"
   ----------------------------------------------------
     Sudo Command: /opt/third-party-app/bin/report

3. run_ third-party-app_report 라는 sudo 규칙을 만듭니다.

   [root@idmclient ~]# ipa sudorule-add run_third-party-app_report
   --------------------------------------------
   Added Sudo Rule "run_third-party-app_report"
   --------------------------------------------
     Rule name: run_third-party-app_report
     Enabled: TRUE

4. --users= <user > 옵션을 사용하여 sudorule-add-runasuser 명령에 대해 RunAs 사용자를 지정합니다.

   [root@idmclient ~]# ipa sudorule-add-runasuser run_third-party-app_report --users=thirdpartyapp
     Rule name: run_third-party-app_report
     Enabled: TRUE
     RunAs External User: thirdpartyapp
   -------------------------
   Number of members added 1
   -------------------------

   로컬 서비스 계정 또는 Active Directory 사용자와 같이 IdM 외부에 있는 사용자(또는 --groups=* 옵션으로 지정된 그룹)가 될 수 있습니다. 그룹 이름에 % 접두사를 추가하지 마십시오.

5. run_ third-party-app_report 규칙에 /opt / third-party-app/report 명령을 추가합니다.

   [root@idmclient ~]# ipa sudorule-add-allow-command run_third-party-app_report --sudocmds '/opt/third-party-app/bin/report'
   Rule name: run_third-party-app_report
   Enabled: TRUE
   Sudo Allow Commands: /opt/third-party-app/bin/report
   RunAs External User: thirdpartyapp
   -------------------------
   Number of members added 1
   -------------------------

6. run_ third-party-app_report 규칙을 IdM idmclient 호스트에 적용합니다.

   [root@idmclient ~]# ipa sudorule-add-host run_third-party-app_report --hosts idmclient.idm.example.com
   Rule name: run_third-party-app_report
   Enabled: TRUE
   Hosts: idmclient.idm.example.com
   Sudo Allow Commands: /opt/third-party-app/bin/report
   RunAs External User: thirdpartyapp
   -------------------------
   Number of members added 1
   -------------------------

7. run_ third-party-app_report 규칙에 idm_user 계정을 추가합니다.

   [root@idmclient ~]# ipa sudorule-add-user run_third-party-app_report --users idm_user
   Rule name: run_third-party-app_report
   Enabled: TRUE
   Users: idm_user
   Hosts: idmclient.idm.example.com
   Sudo Allow Commands: /opt/third-party-app/bin/report
   RunAs External User: thirdpartyapp
   -------------------------
   Number of members added 1

검증

1. idmclient 호스트에 idm_user 계정으로 로그인합니다.

2. 새 sudo 규칙을 테스트합니다.

   1. idm_user 계정에서 수행할 수 있는 sudo 규칙을 표시합니다.

      [idm_user@idmclient ~]$ sudo -l
      Matching Defaults entries for idm_user@idm.example.com on idmclient:
          !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin,
          env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS",
          env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
          env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES",
          env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE",
          env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY KRB5CCNAME",
          secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
      
      User idm_user@idm.example.com may run the following commands on idmclient:
          (thirdpartyapp) /opt/third-party-app/bin/report

   2. report 명령을 타사app 서비스 계정으로 실행합니다.

      [idm_user@idmclient ~]$ sudo -u thirdpartyapp /opt/third-party-app/bin/report
      [sudo] password for idm_user@idm.example.com:
      Executing report...
      Report successful.