Re: Problem with matching group names with domain in sudoers

The group is defined on an ipa server, it should be found through sssd.
So how should I define this rule in sudoers, if I want it to match the 
ipa server group and allow user to run sudo? I thought that %group@domain 
is the right definition.

----- Original Message -----
From: "Todd C. Miller" <[email protected]>
To: "Tomas Sykora" <[email protected]>
Cc: [email protected]
Sent: Friday, March 31, 2017 12:54:30 AM
Subject: Re: [sudo-workers] Problem with matching group names with domain in sudoers

On Thu, 30 Mar 2017 10:42:03 -0400, Tomas Sykora wrote:

> When there is a rule containing a group with a domain in sudoers, e.g.
> 
> %test_group@domain ALL=(ALL) NOPASSWD:ALL
> 
> sudo tries to match strcasecmp("test_group", test_group@domain) in user_in_gr
> oup (pwutil.c),

That's what I would expect it to do.  Unix groups don't really have
the concept of a domain so the @domain is treated literally.  Sudo
AD groups (with a domain) but only with a group provider plugin.

Or is this group part of an NIS domain?

 - todd

-- 

Tomas Sykora
Security Technologies, 
Red Hat Inc.
____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers