Re: sudo + sssd backend on FreeBSD 10.3 client
"Miller, Vincent \(Rick\) via sudo-users" <[email protected]>
| Newsgroups | gmane.comp.tools.sudo.user |
|---|---|
| Message-ID | <[email protected]> |
Hi Todd, Previously sent a mess to the list that is awaiting moderation due to size. Attached to this message is the sanitized sudo log included in the body of the message awaiting moderation. -- Vincent (Rick) Miller UNIX Systems Engineer [email protected] t: 703-948-4395 c: 703-581-3068 12061 Bluemont Way, Reston, VA 20190 -----Original Message----- From: sudo-users <[email protected]> on behalf of "Miller, Vincent (Rick) via sudo-users" <[email protected]> Reply-To: Rick Miller <[email protected]> Date: Tuesday, February 13, 2018 at 4:35 PM To: "Todd C. Miller" <[email protected]> Cc: "[email protected]" <[email protected]> Subject: [EXTERNAL] Re: [sudo-users] sudo + sssd backend on FreeBSD 10.3 client Hi Todd, -----Original Message----- From: "Todd C. Miller" <[email protected]> Date: Tuesday, February 13, 2018 at 12:34 PM To: Rick Miller <[email protected]> Cc: "[email protected]" <[email protected]> Subject: [EXTERNAL] Re: [sudo-users] sudo + sssd backend on FreeBSD 10.3 client On Tue, 13 Feb 2018 15:38:42 +0000, "Miller, Vincent (Rick)" wrote: > Whoops, the sudoers files does not use netgroups and contains only two rules: > > root ALL=(ALL) ALL > %wheel ALL=(ALL) ALL > > As described in the blog and forums posts, relevant bits of nsswitch.conf are > configured: > > # grep sss /etc/nsswitch.conf > group: files sss > passwd: files sss > sudoers: sss files > netgroup: files Just to be clear, you have still get the slowdown with: sudoers: files as well? You only need to list sss in the sudoers nsswitch.conf entry if you are using LDAP-based sudoers with sss and it doesn't sound like you are doing that. There is no slowness when the sudoers line is configured this way. However, sudo errors citing the user is not allowed to run sudo. There is an LDAP-based backend which sssd is configured to communicate with. sudo is compiled and installed with the sssd backend enabled. Removing /etc/netgroup and the netgroup entry from nsswitch.conf prior to executing sudo demonstrates the aforementioned error although another user has stated doing this has resolved their latency problems. This has me confused and I’ve asked for access to that environment to investigate. When sudo starts up it does query all the groups for the invoking user but I would not expect that to involve the netgroups file unless sss stores AD groups as netgroups. You can limit sudo to the group listed stored in the kernel for the user with a line like the following in sudo.conf: Set group_source static It is also possible to log debugging info about what sudo is doing. For example, in sudo.conf: Debug sudo /var/log/sudo_debug all@debug Debug sudoers.so /var/log/sudoers_debug all@debug This will include logging of the internal sudo functions called. When you see the pause before the password prompt, the last few lines of those two log files should let me know where sudo is spending its time. There are copious amounts of debug output to sift through (sudo, sssd, and truss). My latest tests appear to show sssd returning rules from the LDAP server and my previous assertion regarding iterating over /etc/netgroup may be incorrect as it’s possible it was consulted once for each rule returned by the LDAP server. Having said that, A larger system-wide problem that may significantly contribute here has been discovered. Admittedly, my most recent tests are at the lower bounds of the previously described slowness range. Due to this, it’s prudent to gather more data before wasting more of your time. I appreciate your assistance. -- Vincent (Rick) Miller UNIX Systems Engineer [email protected] ____________________________________________________________ sudo-users mailing list <[email protected]> For list information, options, or to unsubscribe, visit: https://www.sudo.ws/mailman/listinfo/sudo-users ____________________________________________________________ sudo-users mailing list <[email protected]> For list information, options, or to unsubscribe, visit: https://www.sudo.ws/mailman/listinfo/sudo-users
sudo1.log
(application/octet-stream, 8.2 KB)
TIME STRTIME UID PID FD ERR PATH ARGS 5272839183534 2018 Feb 14 19:41:01 0 1430 3 0 /usr/share/zoneinfo/UTC sudo -i\0 5272839183585 2018 Feb 14 19:41:01 0 1430 3 0 /usr/share/zoneinfo/posixrules sudo -i\0 5272839183678 2018 Feb 14 19:41:01 0 1430 3 0 /usr/local/etc/sudo.conf sudo -i\0 5272839183876 2018 Feb 14 19:41:01 0 1430 6 0 /usr/local/etc/sudo.conf sudo -i\0 5272839184026 2018 Feb 14 19:41:01 0 1430 6 0 /etc/nsswitch.conf sudo -i\0 5272839184620 2018 Feb 14 19:41:01 0 1430 6 0 /etc/spwd.db sudo -i\0 5272839186699 2018 Feb 14 19:41:01 0 1430 9 0 /etc/spwd.db sudo -i\0 5272839186958 2018 Feb 14 19:41:01 0 1430 9 0 /etc/spwd.db sudo -i\0 5272839187037 2018 Feb 14 19:41:01 0 1430 9 0 /etc/nsswitch.conf sudo -i\0 5272839187394 2018 Feb 14 19:41:01 1 1430 9 0 /usr/local/etc/sudoers sudo -i\0 5272839190741 2018 Feb 14 19:41:01 0 1430 10 0 /usr/local/etc/sudoers.d sudo -i\0 5272839190943 2018 Feb 14 19:41:01 0 1430 -1 2 /etc/sssd/sssd.conf sudo -i\0 5272839796592 2018 Feb 14 19:41:02 0 1430 11 0 /etc/group sudo -i\0 5272839797305 2018 Feb 14 19:41:02 0 1430 11 0 /etc/group sudo -i\0 5272839797774 2018 Feb 14 19:41:02 0 1430 12 0 /etc/group sudo -i\0 5272839798396 2018 Feb 14 19:41:02 0 1430 12 0 /etc/group sudo -i\0 5272839798998 2018 Feb 14 19:41:02 0 1430 12 0 /etc/group sudo -i\0 5272839799516 2018 Feb 14 19:41:02 0 1430 12 0 /etc/group sudo -i\0 5272839800307 2018 Feb 14 19:41:02 0 1430 12 0 /etc/group sudo -i\0 5272839800790 2018 Feb 14 19:41:02 0 1430 12 0 /etc/group sudo -i\0 5272839801707 2018 Feb 14 19:41:02 0 1430 12 0 /etc/group sudo -i\0 5272839802371 2018 Feb 14 19:41:02 0 1430 12 0 /etc/group sudo -i\0 5272839802889 2018 Feb 14 19:41:02 0 1430 12 0 /etc/group sudo -i\0 5272839803437 2018 Feb 14 19:41:02 0 1430 12 0 /etc/group sudo -i\0 5272839819654 2018 Feb 14 19:41:02 0 1430 12 0 /etc/netgroup sudo -i\0 5272840535461 2018 Feb 14 19:41:02 0 1430 12 0 /etc/netgroup sudo -i\0 5272841248751 2018 Feb 14 19:41:03 0 1430 12 0 /etc/netgroup sudo -i\0 5272841959706 2018 Feb 14 19:41:04 0 1430 12 0 /etc/netgroup sudo -i\0 5272842673124 2018 Feb 14 19:41:05 0 1430 12 0 /etc/netgroup sudo -i\0 5272843382637 2018 Feb 14 19:41:05 0 1430 12 0 /etc/netgroup sudo -i\0 5272844088863 2018 Feb 14 19:41:06 0 1430 12 0 /etc/netgroup sudo -i\0 5272844798452 2018 Feb 14 19:41:07 0 1430 12 0 /etc/netgroup sudo -i\0 5272845507226 2018 Feb 14 19:41:07 0 1430 12 0 /etc/netgroup sudo -i\0 5272846217168 2018 Feb 14 19:41:08 0 1430 12 0 /etc/netgroup sudo -i\0 5272846925795 2018 Feb 14 19:41:09 0 1430 12 0 /etc/netgroup sudo -i\0 5272847635134 2018 Feb 14 19:41:10 0 1430 12 0 /etc/netgroup sudo -i\0 5272848345228 2018 Feb 14 19:41:10 0 1430 12 0 /etc/netgroup sudo -i\0 5272849055793 2018 Feb 14 19:41:11 0 1430 12 0 /etc/netgroup sudo -i\0 5272849770319 2018 Feb 14 19:41:12 0 1430 12 0 /etc/netgroup sudo -i\0 5272850473534 2018 Feb 14 19:41:12 0 1430 12 0 /etc/netgroup sudo -i\0 5272851174051 2018 Feb 14 19:41:13 0 1430 12 0 /etc/netgroup sudo -i\0 5272851885532 2018 Feb 14 19:41:14 0 1430 12 0 /etc/netgroup sudo -i\0 5272852599113 2018 Feb 14 19:41:15 0 1430 12 0 /etc/netgroup sudo -i\0 5272853312557 2018 Feb 14 19:41:15 0 1430 12 0 /etc/netgroup sudo -i\0 5272854021882 2018 Feb 14 19:41:16 0 1430 12 0 /etc/netgroup sudo -i\0 5272854731517 2018 Feb 14 19:41:17 0 1430 12 0 /etc/netgroup sudo -i\0 5272855442247 2018 Feb 14 19:41:17 0 1430 12 0 /etc/netgroup sudo -i\0 5272856145408 2018 Feb 14 19:41:18 0 1430 12 0 /etc/netgroup sudo -i\0 5272856845476 2018 Feb 14 19:41:19 0 1430 12 0 /etc/netgroup sudo -i\0 5272857551541 2018 Feb 14 19:41:19 0 1430 12 0 /etc/netgroup sudo -i\0 5272858258343 2018 Feb 14 19:41:20 0 1430 12 0 /etc/netgroup sudo -i\0 5272858968854 2018 Feb 14 19:41:21 0 1430 12 0 /etc/netgroup sudo -i\0 5272859682634 2018 Feb 14 19:41:22 0 1430 12 0 /etc/netgroup sudo -i\0 5272860397474 2018 Feb 14 19:41:22 0 1430 12 0 /etc/netgroup sudo -i\0 5272861110242 2018 Feb 14 19:41:23 0 1430 12 0 /etc/netgroup sudo -i\0 5272861815213 2018 Feb 14 19:41:24 0 1430 12 0 /etc/netgroup sudo -i\0 5272862519265 2018 Feb 14 19:41:24 0 1430 12 0 /etc/netgroup sudo -i\0 5272863224176 2018 Feb 14 19:41:25 0 1430 12 0 /etc/netgroup sudo -i\0 5272863927562 2018 Feb 14 19:41:26 0 1430 12 0 /etc/netgroup sudo -i\0 5272864631482 2018 Feb 14 19:41:27 0 1430 12 0 /etc/netgroup sudo -i\0 5272865336012 2018 Feb 14 19:41:27 0 1430 12 0 /etc/netgroup sudo -i\0 5272866040505 2018 Feb 14 19:41:28 0 1430 12 0 /etc/netgroup sudo -i\0 5272866743758 2018 Feb 14 19:41:29 0 1430 12 0 /etc/netgroup sudo -i\0 5272867448858 2018 Feb 14 19:41:29 0 1430 12 0 /etc/netgroup sudo -i\0 5272868153183 2018 Feb 14 19:41:30 0 1430 12 0 /etc/netgroup sudo -i\0 5272868857816 2018 Feb 14 19:41:31 0 1430 12 0 /etc/pam.d/sudo sudo -i\0 5272868862507 2018 Feb 14 19:41:31 0 1430 13 0 /var/run/utx.active sudo -i\0 5272868862899 2018 Feb 14 19:41:31 0 1430 13 0 /etc/opiekeys sudo -i\0 5272868862946 2018 Feb 14 19:41:31 0 1430 13 0 /etc/spwd.db sudo -i\0 5272868862985 2018 Feb 14 19:41:31 0 1430 13 0 /etc/opiekeys sudo -i\0 5272868863017 2018 Feb 14 19:41:31 0 1430 13 0 /etc/krb5.conf sudo -i\0 5272868863075 2018 Feb 14 19:41:31 0 1430 -1 2 /usr/lib/plugin/krb5 sudo -i\0 5272868863220 2018 Feb 14 19:41:31 0 1430 -1 2 /usr/lib/plugin/krb5 sudo -i\0 5272878413462 2018 Feb 14 19:41:40 0 1430 13 0 /etc/spwd.db sudo -i\0 5272878413613 2018 Feb 14 19:41:40 0 1430 13 0 /etc/services sudo -i\0 5272878413713 2018 Feb 14 19:41:40 0 1430 13 0 /etc/hosts sudo -i\0 5272878413760 2018 Feb 14 19:41:40 0 1430 13 0 /etc/resolv.conf sudo -i\0 5272878432781 2018 Feb 14 19:41:40 0 1430 13 0 /etc/services sudo -i\0 5272878432913 2018 Feb 14 19:41:40 0 1430 13 0 /etc/hosts sudo -i\0 5272878469978 2018 Feb 14 19:41:40 0 1430 13 0 /etc/hosts sudo -i\0 5272878470204 2018 Feb 14 19:41:40 0 1430 13 0 /etc/hosts sudo -i\0 5272878470343 2018 Feb 14 19:41:40 0 1430 13 0 /etc/services sudo -i\0 5272878470426 2018 Feb 14 19:41:40 0 1430 13 0 /etc/hosts sudo -i\0 5272878481585 2018 Feb 14 19:41:40 0 1430 13 0 /etc/login.access sudo -i\0 5272878481622 2018 Feb 14 19:41:40 0 1430 13 0 /etc/spwd.db sudo -i\0 5272878481680 2018 Feb 14 19:41:40 0 1430 13 0 /etc/login.conf.db sudo -i\0 5272878481709 2018 Feb 14 19:41:40 0 1430 13 0 /etc/ttys sudo -i\0 5272878676005 2018 Feb 14 19:41:41 0 1430 9 0 /etc/spwd.db sudo -i\0 5272878676324 2018 Feb 14 19:41:41 0 1430 9 0 /etc/spwd.db sudo -i\0 5272878676573 2018 Feb 14 19:41:41 0 1430 12 0 /var/log/utx.lastlogin sudo -i\0 5272878676654 2018 Feb 14 19:41:41 0 1430 12 0 /var/run/utx.active sudo -i\0 5272878676700 2018 Feb 14 19:41:41 0 1430 12 0 /var/log/utx.lastlogin sudo -i\0 5272878676725 2018 Feb 14 19:41:41 0 1430 12 0 /var/log/utx.log sudo -i\0 5272878676762 2018 Feb 14 19:41:41 0 1430 12 0 /etc/spwd.db sudo -i\0