sudoers questions

[Andrew Meyer]

Hello, I have been doing a lot of research on trying to get host groups to work with sudoers policies.  However I'm finding that this can't be done and the only achieved by using netgroups.  Is this true?    I just would like some validation/confirmation before I go to far down the rabbit hole.

[Rob Crittenden]

Andrew Meyer via FreeIPA-users wrote:
> Hello, 
> I have been doing a lot of research on trying to get host groups to work
> with sudoers policies.  However I'm finding that this can't be done and
> the only achieved by using netgroups.  Is this true?    I just would
> like some validation/confirmation before I go to far down the rabbit hole.

A hostgroup automatically creates a netgroup of the same name. Lookups
are done on the end system as a netgroup so you need to be sure that the
NIS domainname is set (should be done automatically by ipa-client-install).

rob

[Andrew Meyer]

Yes, but what about adding the hostgroup to the sudo policy?  Do I still need to add the netgroup instead?

On Wednesday, April 18, 2018 10:17 AM, Rob Crittenden via FreeIPA-users  wrote:

Andrew Meyer via FreeIPA-users wrote:
> Hello, 
> I have been doing a lot of research on trying to get host groups to work
> with sudoers policies.  However I'm finding that this can't be done and
> the only achieved by using netgroups.  Is this true?    I just would
> like some validation/confirmation before I go to far down the rabbit hole.

A hostgroup automatically creates a netgroup of the same name. Lookups
are done on the end system as a netgroup so you need to be sure that the
NIS domainname is set (should be done automatically by ipa-client-install).

rob
_______________________________________________
FreeIPA-users mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]

[Rob Crittenden]

Andrew Meyer wrote:
> Yes, but what about adding the hostgroup to the sudo policy?  Do I still
> need to add the netgroup instead?

sudorule-add-host              Add hosts and hostgroups affected by Sudo
Rule.

hostgroups are represented as netgroups.

rob
> On Wednesday, April 18, 2018 10:17 AM, Rob Crittenden via FreeIPA-users
>  wrote:
>
> Andrew Meyer via FreeIPA-users wrote:
> > Hello, 
> > I have been doing a lot of research on trying to get host groups to work
> > with sudoers policies.  However I'm finding that this can't be done and
> > the only achieved by using netgroups.  Is this true?    I just would
> > like some validation/confirmation before I go to far down the rabbit hole.
>
> A hostgroup automatically creates a netgroup of the same name. Lookups
> are done on the end system as a netgroup so you need to be sure that the
> NIS domainname is set (should be done automatically by ipa-client-install).
>
> rob
>
> FreeIPA-users mailing list -- [e-mail]
>
> To unsubscribe send an email to
> [e-mail]