Sudo
Central sudo rules: who, on which host, as whom, which commands; commands and command groups, deny lists, options, and what sudo order does.
Sudo rules move every host's /etc/sudoers into the directory. The client's sssd sudo provider fetches them; sudo -l shows what is defined here. The local /etc/sudoers still applies, the two are a union. Not gated by a licence module.
Parts of a rule
| Block | sudoers equivalent | Notes |
|---|---|---|
| Who | users / user groups | "Anyone" = ALL |
| Access this host | hosts / host groups | "Any host" = ALL |
| Run commands | allowed sudo commands / command groups; denied commands / groups | "Any command" = ALL. The deny list is subtracted after the allow list |
| As whom | RunAs users / groups | empty = root. "Anyone" = ALL, i.e. sudo -u <any user> |
| Options | Defaults entries | !authenticate (no password), env_keep, log_output…, written exactly as sudoers option names |
| Sudo order | sudoOrder | priority when several rules match; the higher number wins. Empty counts as 0 |
The shipped rule all is empty and disabled: a blank template.
Commands must be absolute paths and may carry arguments (/usr/bin/systemctl restart httpd); /usr/bin/systemctl alone allows any argument. Wildcards in arguments follow sudoers rules.
Commands and command groups
A command is registered on the Sudo commands page first, then referenced by rules; one command can serve several rules. Command groups bundle a family (service-control: restart httpd, restart nginx, journalctl); rules reference the group, and a new command only changes the group.
Relation to HBAC
Both gates must open: HBAC allows the sudo service for that user on that host (allow_all or a dedicated rule), and a sudo rule carries the command. With only the sudo rule in place and HBAC not allowing sudo, the client reports a wrong password or refuses outright.
Client
# /etc/sssd/sssd.conf
[sssd]
services = nss, pam, sudo
# /etc/nsswitch.conf
sudoers: files sssipa-client-install configures this. Propagation delay: sssd does a full refresh every 6 hours and a smart refresh every 15 minutes (ldap_sudo_full_refresh_interval, ldap_sudo_smart_refresh_interval). sss_cache -E when it cannot wait.
Boundaries
- Password-less (
!authenticate) is a rule option and applies to the whole rule, not per command. - RunAs users / groups must be IPA or AD users; a local user such as
postgresgoes in the "external" field by name. - Hosts can also match by network (
ipa sudorule-add-host --hostmask=192.168.57.0/24); the UI offers hosts and host groups only.
Host-based access control (HBAC)
Requires the hbac module. Who may log in to which host through which service, the four dimensions of a rule, what to do with allow_all, evaluation order, and simulating a login with ipa hbactest.
SELinux user maps
Change the SELinux user an IPA login runs as from the default unconfined_u to a confined one; how maps match, the list of available SELinux users and its order.