5.4. Enabling passwordless sudo authentication for smart-card users

Procedure

1. Set up constraint delegation rules to list which hosts the ticket can access.

   例 5.1. Setting up constraint delegation rules

   The web console session runs host host.example.com and should be trusted to access its own host with sudo. Additionally, we are adding second trusted host - remote.example.com.

   • Create the following delegation:

     • Run the following commands to add a list of target machines a particular rule can access:

       # ipa servicedelegationtarget-add cockpit-target
       # ipa servicedelegationtarget-add-member cockpit-target \ --principals=host/host.example.com@EXAMPLE.COM \ --principals=host/remote.example.com@EXAMPLE.COM

     • To allow the web console sessions (HTTP/principal) to access that host list, use the following commands:

       # ipa servicedelegationrule-add cockpit-delegation
       # ipa servicedelegationrule-add-member cockpit-delegation \ --principals=HTTP/host.example.com@EXAMPLE.COM
       # ipa servicedelegationrule-add-target cockpit-delegation \ --servicedelegationtargets=cockpit-target

2. Enable GSS authentication in the corresponding services:

   1. For sudo, enable the pam_sss_gss module in the /etc/sssd/sssd.conf file:

      1. As root, add an entry for your domain to the /etc/sssd/sssd.conf configuration file.

         [domain/example.com]
         pam_gssapi_services = sudo, sudo-i

      2. Enable the module in the /etc/pam.d/sudo file on the first line.

         auth sufficient pam_sss_gss.so

   2. For SSH, update the GSSAPIAuthentication option in the /etc/ssh/sshd_config file to yes.

Verification

1. Log in to the web console using a smart card.
2. Click the Limited access button.
3. Authenticate using your smart card.