Sudo
Central sudo rules covering who, on which host, as whom and which commands; commands and command groups, deny lists, options, and what sudo order does.
This page covers the Sudo pages under Policy. Sudo rules move every host's /etc/sudoers into the directory. The client's sssd sudo provider fetches them, and sudo -l shows what is defined here. The local /etc/sudoers still applies; the two are a union. Not gated by a licence module.
Parts of a rule
| Block | sudoers equivalent | Notes |
|---|---|---|
| Who | Users, user groups | Anyone is ALL |
| Access this host | Hosts, host groups | Any host is ALL |
| Run commands | Allowed sudo commands and command groups; denied commands and groups | Any command is ALL. The deny list is subtracted after the allow list |
| As whom | RunAs users, groups | Empty means root. Anyone is ALL, that is sudo -u any user |
| Options | Defaults entries | !authenticate (no password), env_keep, log_output and so on, written exactly as sudoers option names |
| Sudo order | sudoOrder | Priority when several rules match; the higher number wins. Empty counts as 0 |
The shipped rule all is empty and disabled: a blank template.
Commands must be absolute paths and may carry arguments (/usr/bin/systemctl restart httpd); /usr/bin/systemctl alone allows any argument. Wildcards in arguments follow sudoers rules.
Commands and command groups
A command is registered on the Sudo commands page first, then referenced by rules; one command can serve several rules. Command groups bundle a family (service-control: restart httpd, restart nginx, journalctl). Rules reference the group, and a new command only changes the group.
Relation to HBAC
Both gates must open: HBAC allows the sudo service for that user on that host (allow_all or a dedicated rule), and a sudo rule carries the command. With only the sudo rule in place and HBAC not allowing sudo, the client reports a wrong password or refuses outright.
Client
# /etc/sssd/sssd.conf
[sssd]
services = nss, pam, sudo
# /etc/nsswitch.conf
sudoers: files sssipa-client-install configures this. Propagation delay: sssd does a full refresh every 6 hours and a smart refresh every 15 minutes (ldap_sudo_full_refresh_interval, ldap_sudo_smart_refresh_interval). sss_cache -E forces it.
Boundaries
| Topic | Notes |
|---|---|
| Password-less | !authenticate is a rule option and applies to the whole rule, not per command |
| RunAs targets | Must be IPA or AD users and groups. A local user such as postgres goes in the External field by name |
| Matching hosts by network | CLI only: ipa sudorule-add-host --hostmask=192.168.57.0/24. The UI offers hosts and host groups |
Host-based access control (HBAC)
Requires the hbac module. Who may log in to which host through which service, the four dimensions of a rule, what to do with allow_all, evaluation order, and simulating a login with ipa hbactest.
SELinux user maps
Change the SELinux user an IPA login runs as from the default unconfined_u to a confined one; how maps match, the list of available SELinux users and its order.