How to implement sudo for "ALL, !something"

[Ranbir]

Hi Everyone,

We have sudo rules like this on plain, non-freeipa domain CentOS
servers:

%group		ALL=(someuser)	ALL,!SU,!SHELLS

How would I implement the above in a freeipa domain? I've tried to name
my rules 01-group and 02-group and put the above into two separate
rules, but it didn't work. I tried to set only what's not allowed, but
that didn't work either.

I'm now thoroughly confused! Can anyone lend a hand?

Thanks in advance!

Ranbir

[Ranbir]

On Sun, 2017-09-24 at 02:28 -0400, Ranbir via FreeIPA-users wrote:
> I'm now thoroughly confused! Can anyone lend a hand?

I think I managed to achieve what I wanted by specifying a "sudo
order". Now I can give the user the ability to run every command as
another user (that that user is allowed to run), with the exceptions of
/bin/su and any shells.

[Rob Crittenden]

Ranbir via FreeIPA-users wrote:
> On Sun, 2017-09-24 at 02:28 -0400, Ranbir via FreeIPA-users wrote:
> > I'm now thoroughly confused! Can anyone lend a hand?
>
> I think I managed to achieve what I wanted by specifying a "sudo
> order". Now I can give the user the ability to run every command as
> another user (that that user is allowed to run), with the exceptions of
> /bin/su and any shells.

I'd refer you to the SECURITY NOTES in the sudoers man page to
reconsider this approach.

rob

[Ranbir]

On Mon, 2017-09-25 at 11:00 -0400, Rob Crittenden wrote:
> I'd refer you to the SECURITY NOTES in the sudoers man page to
> reconsider this approach.

You're referring to giving sudo to all commands and then trying to take
some things away? Ya, it's stupid, doesn't actually work and I don't
know why it's setup like this (it's from before my time here). I'm
going to attempt convincing the organization to change it.

For now, we're just testing out if our current crappy rule sets can be
replicated within freeipa.

Thanks for pointing it out, though! I'll reference this thread in the
future. lol