Re: Converting from sudoers to ldif

Il giorno 19 feb 2018, alle ore 03:39, Todd C. Miller <[email protected]> ha scritto:
> I'm not sure I understand.  Do you mean that you'd like to be able
> to specify a starting number (or range) for sudoOrder when converting
> to LDIF?
> Currently, cvtsudoers uses a sudoOrder of 1 for the first sudoRole
> and increments by one for each sudoOrder.  I'm open to making that
> more configurable.

Sorry for the delay.

Yes, I would like to have a customizable way to set the sudoOrder.

A possible suggestion is to have a config file for cvtsudoers, that define if there must be a sudoOrder or not.

Also, please consider the following:
aaron	shanty = /usr/sbin/tcpdump, NOEXEC: /usr/bin/more, /usr/bin/vi

On LDAP, to the best of my knowledge, this is translated to two entries.
Of course, in this case the sudoOrder does apply.

To deal with that use case i am not sure which is the best.
Probably again a configuration file.


Example (proto code):
headerchars: 3 (means take 3 character, that can be enforced to be numbers)
sudoOrderOffset: 2 (mean take 2 number for sudoOrder in addition to be above one.

In the above case, a file called:
100-aaron
That contains
“”"
aaron	shanty = /usr/sbin/tcpdump, NOEXEC: /usr/bin/more, /usr/bin/vi
“”"

Lead to two LDAP entries:
1:
/usr/sbin/tcpdump
sudoOrder: 10001

2:
NOEXEC: /usr/bin/more, /usr/bin/vi
sudoOrder: 10002

There are a number of constraint and possible solution, i am open to evaluate it all.
And of course to make some beta test.

HTH,
Daniele

____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users

-----BEGIN PGP SIGNATURE-----

iF0EARECAB0WIQQ2i6u6VhCxV1aSkPHxOPmZ9ILUVAUCWo9dpwAKCRDxOPmZ9ILU
VCXXAJ9Bwc4gPpL92ziOCyhwA3WJjQqohwCdFo061OOKMFNwRudSR64QQYbpEMU=
=Jjyu
-----END PGP SIGNATURE-----