8.5. 在 CLI 上创建 sudo 规则，以作为 IdM 客户端上的服务帐户运行命令
在 IdM 中，您可以使用 RunAs alias 配置 sudo 规则，以便以另一个用户或组身份运行 sudo 命令。例如，您可能有一个托管数据库应用的 IdM 客户端，您需要以与该应用对应的本地服务帐户运行命令。
使用这个示例在命令行上创建一个名为 run_third-parent-app_report 的 sudo 规则，以允许 idm_user 帐户以 idmclient 主机上 thirdpartyapp 服务帐户的身份运行 /opt/third-party-app/bin/report 命令。
先决条件
- 以 IdM 管理员身份登录。
-
您已在 IdM 中创建
了 idm_user的用户帐户，并通过为用户创建密码来解锁帐户。有关使用 CLI 添加新 IdM 用户的详情，请参阅使用命令行添加用户。 -
idmclient主机上没有本地的idm_user。idm_user用户未列在本地/etc/passwd文件中。 -
您已在
idmclient主机上已安装了一个名为third-party-app的自定义应用程序。 -
用于
third-party-app的report命令安装在/opt/third- party-app/bin/report目录中。 -
您已创建了一个名为
thirdrdapp的本地服务帐户，来执行third-party-app应用程序的命令。
步骤
获取 Kerberos 票据作为 IdM
admin。[root@idmclient ~]# kinit admin将
/opt/third-party-app/bin/report命令添加到sudo命令的 IdM 数据库中：[root@idmclient ~]# ipa sudocmd-add /opt/third-party-app/bin/report ---------------------------------------------------- Added Sudo Command "/opt/third-party-app/bin/report" ---------------------------------------------------- Sudo Command: /opt/third-party-app/bin/report创建一个名为
run_third-party-app_report的sudo规则：[root@idmclient ~]# ipa sudorule-add run_third-party-app_report -------------------------------------------- Added Sudo Rule "run_third-party-app_report" -------------------------------------------- Rule name: run_third-party-app_report Enabled: TRUE使用
--users=<user>选项来为sudorule-add-runasuser命令指定 RunAs 用户：[root@idmclient ~]# ipa sudorule-add-runasuser run_third-party-app_report --users=thirdpartyapp Rule name: run_third-party-app_report Enabled: TRUE RunAs External User: thirdpartyapp ------------------------- Number of members added 1 -------------------------用户（或用
--groups=*选项指定的组）可以是来自 IdM 外部，如本地服务帐户或活动目录用户。不要为组名称添加%前缀。将
/opt/third-party-app/bin/report命令添加到run_third-party-app_report规则中：[root@idmclient ~]# ipa sudorule-add-allow-command run_third-party-app_report --sudocmds '/opt/third-party-app/bin/report' Rule name: run_third-party-app_report Enabled: TRUE Sudo Allow Commands: /opt/third-party-app/bin/report RunAs External User: thirdpartyapp ------------------------- Number of members added 1 -------------------------将
run_third- party-app_report规则应用到 IdMidmclient主机：[root@idmclient ~]# ipa sudorule-add-host run_third-party-app_report --hosts idmclient.idm.example.com Rule name: run_third-party-app_report Enabled: TRUE Hosts: idmclient.idm.example.com Sudo Allow Commands: /opt/third-party-app/bin/report RunAs External User: thirdpartyapp ------------------------- Number of members added 1 -------------------------将
idm_user帐户添加到run_third- party-app_report规则中：[root@idmclient ~]# ipa sudorule-add-user run_third-party-app_report --users idm_user Rule name: run_third-party-app_report Enabled: TRUE Users: idm_user Hosts: idmclient.idm.example.com Sudo Allow Commands: /opt/third-party-app/bin/report RunAs External User: thirdpartyapp ------------------------- Number of members added 1
将更改从服务器传播到客户端可能需要几分钟时间。
验证步骤
-
以
idm_user帐户身份登录idmclient主机。 测试新的 sudo 规则：
显示允许
idm_user帐户执行的sudo规则。[idm_user@idmclient ~]$ sudo -l Matching Defaults entries for idm_user@idm.example.com on idmclient: !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY KRB5CCNAME", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin User idm_user@idm.example.com may run the following commands on idmclient: (thirdpartyapp) /opt/third-party-app/bin/report
作为
thirdpartyapp服务帐户，运行report命令。[idm_user@idmclient ~]$ sudo -u thirdpartyapp /opt/third-party-app/bin/report [sudo] password for idm_user@idm.example.com: Executing report... Report successful.
