Annotation of embedaddon/sudo/doc/sudoers.ldap.cat, revision 1.1
1.1 ! misho 1: SUDOERS.LDAP(4) MAINTENANCE COMMANDS SUDOERS.LDAP(4)
! 2:
! 3:
! 4:
! 5: NNAAMMEE
! 6: sudoers.ldap - sudo LDAP configuration
! 7:
! 8: DDEESSCCRRIIPPTTIIOONN
! 9: In addition to the standard _s_u_d_o_e_r_s file, ssuuddoo may be configured via
! 10: LDAP. This can be especially useful for synchronizing _s_u_d_o_e_r_s in a
! 11: large, distributed environment.
! 12:
! 13: Using LDAP for _s_u_d_o_e_r_s has several benefits:
! 14:
! 15: +o ssuuddoo no longer needs to read _s_u_d_o_e_r_s in its entirety. When LDAP is
! 16: used, there are only two or three LDAP queries per invocation.
! 17: This makes it especially fast and particularly usable in LDAP
! 18: environments.
! 19:
! 20: +o ssuuddoo no longer exits if there is a typo in _s_u_d_o_e_r_s. It is not
! 21: possible to load LDAP data into the server that does not conform to
! 22: the sudoers schema, so proper syntax is guaranteed. It is still
! 23: possible to have typos in a user or host name, but this will not
! 24: prevent ssuuddoo from running.
! 25:
! 26: +o It is possible to specify per-entry options that override the
! 27: global default options. _/_e_t_c_/_s_u_d_o_e_r_s only supports default options
! 28: and limited options associated with user/host/commands/aliases.
! 29: The syntax is complicated and can be difficult for users to
! 30: understand. Placing the options directly in the entry is more
! 31: natural.
! 32:
! 33: +o The vviissuuddoo program is no longer needed. vviissuuddoo provides locking
! 34: and syntax checking of the _/_e_t_c_/_s_u_d_o_e_r_s file. Since LDAP updates
! 35: are atomic, locking is no longer necessary. Because syntax is
! 36: checked when the data is inserted into LDAP, there is no need for a
! 37: specialized tool to check syntax.
! 38:
! 39: Another major difference between LDAP and file-based _s_u_d_o_e_r_s is that in
! 40: LDAP, ssuuddoo-specific Aliases are not supported.
! 41:
! 42: For the most part, there is really no need for ssuuddoo-specific Aliases.
! 43: Unix groups or user netgroups can be used in place of User_Aliases and
! 44: Runas_Aliases. Host netgroups can be used in place of Host_Aliases.
! 45: Since Unix groups and netgroups can also be stored in LDAP there is no
! 46: real need for ssuuddoo-specific aliases.
! 47:
! 48: Cmnd_Aliases are not really required either since it is possible to
! 49: have multiple users listed in a sudoRole. Instead of defining a
! 50: Cmnd_Alias that is referenced by multiple users, one can create a
! 51: sudoRole that contains the commands and assign multiple users to it.
! 52:
! 53: SSUUDDOOeerrss LLDDAAPP ccoonnttaaiinneerr
! 54: The _s_u_d_o_e_r_s configuration is contained in the ou=SUDOers LDAP
! 55: container.
! 56:
! 57: Sudo first looks for the cn=default entry in the SUDOers container. If
! 58: found, the multi-valued sudoOption attribute is parsed in the same
! 59: manner as a global Defaults line in _/_e_t_c_/_s_u_d_o_e_r_s. In the following
! 60: example, the SSH_AUTH_SOCK variable will be preserved in the
! 61: environment for all users.
! 62:
! 63: dn: cn=defaults,ou=SUDOers,dc=example,dc=com
! 64: objectClass: top
! 65: objectClass: sudoRole
! 66: cn: defaults
! 67: description: Default sudoOption's go here
! 68: sudoOption: env_keep+=SSH_AUTH_SOCK
! 69:
! 70: The equivalent of a sudoer in LDAP is a sudoRole. It consists of the
! 71: following attributes:
! 72:
! 73: ssuuddooUUsseerr
! 74: A user name, uid (prefixed with '#'), Unix group (prefixed with a
! 75: '%') or user netgroup (prefixed with a '+').
! 76:
! 77: ssuuddooHHoosstt
! 78: A host name, IP address, IP network, or host netgroup (prefixed
! 79: with a '+'). The special value ALL will match any host.
! 80:
! 81: ssuuddooCCoommmmaanndd
! 82: A Unix command with optional command line arguments, potentially
! 83: including globbing characters (aka wild cards). The special value
! 84: ALL will match any command. If a command is prefixed with an
! 85: exclamation point '!', the user will be prohibited from running
! 86: that command.
! 87:
! 88: ssuuddooOOppttiioonn
! 89: Identical in function to the global options described above, but
! 90: specific to the sudoRole in which it resides.
! 91:
! 92: ssuuddooRRuunnAAssUUsseerr
! 93: A user name or uid (prefixed with '#') that commands may be run as
! 94: or a Unix group (prefixed with a '%') or user netgroup (prefixed
! 95: with a '+') that contains a list of users that commands may be run
! 96: as. The special value ALL will match any user.
! 97:
! 98: The sudoRunAsUser attribute is only available in ssuuddoo versions
! 99: 1.7.0 and higher. Older versions of ssuuddoo use the sudoRunAs
! 100: attribute instead.
! 101:
! 102: ssuuddooRRuunnAAssGGrroouupp
! 103: A Unix group or gid (prefixed with '#') that commands may be run
! 104: as. The special value ALL will match any group.
! 105:
! 106: The sudoRunAsGroup attribute is only available in ssuuddoo versions
! 107: 1.7.0 and higher.
! 108:
! 109: ssuuddooNNoottBBeeffoorree
! 110: A timestamp in the form yyyymmddHHMMSSZ that can be used to provide
! 111: a start date/time for when the sudoRole will be valid. If multiple
! 112: sudoNotBefore entries are present, the earliest is used. Note that
! 113: timestamps must be in Coordinated Universal Time (UTC), not the
! 114: local timezone. The minute and seconds portions are optional, but
! 115: some LDAP servers require that they be present (contrary to the
! 116: RFC).
! 117:
! 118: The sudoNotBefore attribute is only available in ssuuddoo versions
! 119: 1.7.5 and higher and must be explicitly enabled via the
! 120: SSUUDDOOEERRSS__TTIIMMEEDD option in _/_e_t_c_/_l_d_a_p_._c_o_n_f.
! 121:
! 122: ssuuddooNNoottAAfftteerr
! 123: A timestamp in the form yyyymmddHHMMSSZ that indicates an
! 124: expiration date/time, after which the sudoRole will no longer be
! 125: valid. If multiple sudoNotBefore entries are present, the last one
! 126: is used. Note that timestamps must be in Coordinated Universal
! 127: Time (UTC), not the local timezone. The minute and seconds
! 128: portions are optional, but some LDAP servers require that they be
! 129: present (contrary to the RFC).
! 130:
! 131: The sudoNotAfter attribute is only available in ssuuddoo versions 1.7.5
! 132: and higher and must be explicitly enabled via the SSUUDDOOEERRSS__TTIIMMEEDD
! 133: option in _/_e_t_c_/_l_d_a_p_._c_o_n_f.
! 134:
! 135: ssuuddooOOrrddeerr
! 136: The sudoRole entries retrieved from the LDAP directory have no
! 137: inherent order. The sudoOrder attribute is an integer (or floating
! 138: point value for LDAP servers that support it) that is used to sort
! 139: the matching entries. This allows LDAP-based sudoers entries to
! 140: more closely mimic the behaviour of the sudoers file, where the of
! 141: the entries influences the result. If multiple entries match, the
! 142: entry with the highest sudoOrder attribute is chosen. This
! 143: corresponds to the "last match" behavior of the sudoers file. If
! 144: the sudoOrder attribute is not present, a value of 0 is assumed.
! 145:
! 146: The sudoOrder attribute is only available in ssuuddoo versions 1.7.5
! 147: and higher.
! 148:
! 149: Each attribute listed above should contain a single value, but there
! 150: may be multiple instances of each attribute type. A sudoRole must
! 151: contain at least one sudoUser, sudoHost and sudoCommand.
! 152:
! 153: The following example allows users in group wheel to run any command on
! 154: any host via ssuuddoo:
! 155:
! 156: dn: cn=%wheel,ou=SUDOers,dc=example,dc=com
! 157: objectClass: top
! 158: objectClass: sudoRole
! 159: cn: %wheel
! 160: sudoUser: %wheel
! 161: sudoHost: ALL
! 162: sudoCommand: ALL
! 163:
! 164: AAnnaattoommyy ooff LLDDAAPP ssuuddooeerrss llooookkuupp
! 165: When looking up a sudoer using LDAP there are only two or three LDAP
! 166: queries per invocation. The first query is to parse the global
! 167: options. The second is to match against the user's name and the groups
! 168: that the user belongs to. (The special ALL tag is matched in this
! 169: query too.) If no match is returned for the user's name and groups, a
! 170: third query returns all entries containing user netgroups and checks to
! 171: see if the user belongs to any of them.
! 172:
! 173: If timed entries are enabled with the SSUUDDOOEERRSS__TTIIMMEEDD configuration
! 174: directive, the LDAP queries include a subfilter that limits retrieval
! 175: to entries that satisfy the time constraints, if any.
! 176:
! 177: DDiiffffeerreenncceess bbeettwweeeenn LLDDAAPP aanndd nnoonn--LLDDAAPP ssuuddooeerrss
! 178: There are some subtle differences in the way sudoers is handled once in
! 179: LDAP. Probably the biggest is that according to the RFC, LDAP ordering
! 180: is arbitrary and you cannot expect that Attributes and Entries are
! 181: returned in any specific order.
! 182:
! 183: The order in which different entries are applied can be controlled
! 184: using the sudoOrder attribute, but there is no way to guarantee the
! 185: order of attributes within a specific entry. If there are conflicting
! 186: command rules in an entry, the negative takes precedence. This is
! 187: called paranoid behavior (not necessarily the most specific match).
! 188:
! 189: Here is an example:
! 190:
! 191: # /etc/sudoers:
! 192: # Allow all commands except shell
! 193: johnny ALL=(root) ALL,!/bin/sh
! 194: # Always allows all commands because ALL is matched last
! 195: puddles ALL=(root) !/bin/sh,ALL
! 196:
! 197: # LDAP equivalent of johnny
! 198: # Allows all commands except shell
! 199: dn: cn=role1,ou=Sudoers,dc=my-domain,dc=com
! 200: objectClass: sudoRole
! 201: objectClass: top
! 202: cn: role1
! 203: sudoUser: johnny
! 204: sudoHost: ALL
! 205: sudoCommand: ALL
! 206: sudoCommand: !/bin/sh
! 207:
! 208: # LDAP equivalent of puddles
! 209: # Notice that even though ALL comes last, it still behaves like
! 210: # role1 since the LDAP code assumes the more paranoid configuration
! 211: dn: cn=role2,ou=Sudoers,dc=my-domain,dc=com
! 212: objectClass: sudoRole
! 213: objectClass: top
! 214: cn: role2
! 215: sudoUser: puddles
! 216: sudoHost: ALL
! 217: sudoCommand: !/bin/sh
! 218: sudoCommand: ALL
! 219:
! 220: Another difference is that negations on the Host, User or Runas are
! 221: currently ignored. For example, the following attributes do not behave
! 222: the way one might expect.
! 223:
! 224: # does not match all but joe
! 225: # rather, does not match anyone
! 226: sudoUser: !joe
! 227:
! 228: # does not match all but joe
! 229: # rather, matches everyone including Joe
! 230: sudoUser: ALL
! 231: sudoUser: !joe
! 232:
! 233: # does not match all but web01
! 234: # rather, matches all hosts including web01
! 235: sudoHost: ALL
! 236: sudoHost: !web01
! 237:
! 238: SSuuddooeerrss SScchheemmaa
! 239: In order to use ssuuddoo's LDAP support, the ssuuddoo schema must be installed
! 240: on your LDAP server. In addition, be sure to index the 'sudoUser'
! 241: attribute.
! 242:
! 243: Three versions of the schema: one for OpenLDAP servers
! 244: (_s_c_h_e_m_a_._O_p_e_n_L_D_A_P), one for Netscape-derived servers (_s_c_h_e_m_a_._i_P_l_a_n_e_t),
! 245: and one for Microsoft Active Directory (_s_c_h_e_m_a_._A_c_t_i_v_e_D_i_r_e_c_t_o_r_y) may be
! 246: found in the ssuuddoo distribution.
! 247:
! 248: The schema for ssuuddoo in OpenLDAP form is included in the EXAMPLES
! 249: section.
! 250:
! 251: CCoonnffiigguurriinngg llddaapp..ccoonnff
! 252: Sudo reads the _/_e_t_c_/_l_d_a_p_._c_o_n_f file for LDAP-specific configuration.
! 253: Typically, this file is shared amongst different LDAP-aware clients.
! 254: As such, most of the settings are not ssuuddoo-specific. Note that ssuuddoo
! 255: parses _/_e_t_c_/_l_d_a_p_._c_o_n_f itself and may support options that differ from
! 256: those described in the _l_d_a_p_._c_o_n_f(4) manual.
! 257:
! 258: Also note that on systems using the OpenLDAP libraries, default values
! 259: specified in _/_e_t_c_/_o_p_e_n_l_d_a_p_/_l_d_a_p_._c_o_n_f or the user's _._l_d_a_p_r_c files are
! 260: not used.
! 261:
! 262: Only those options explicitly listed in _/_e_t_c_/_l_d_a_p_._c_o_n_f as being
! 263: supported by ssuuddoo are honored. Configuration options are listed below
! 264: in upper case but are parsed in a case-independent manner.
! 265:
! 266: UURRII ldap[s]://[hostname[:port]] ...
! 267: Specifies a whitespace-delimited list of one or more URIs
! 268: describing the LDAP server(s) to connect to. The _p_r_o_t_o_c_o_l may be
! 269: either llddaapp or llddaappss, the latter being for servers that support TLS
! 270: (SSL) encryption. If no _p_o_r_t is specified, the default is port 389
! 271: for ldap:// or port 636 for ldaps://. If no _h_o_s_t_n_a_m_e is specified,
! 272: ssuuddoo will connect to llooccaallhhoosstt. Multiple UURRII lines are treated
! 273: identically to a UURRII line containing multiple entries. Only
! 274: systems using the OpenSSL libraries support the mixing of ldap://
! 275: and ldaps:// URIs. The Netscape-derived libraries used on most
! 276: commercial versions of Unix are only capable of supporting one or
! 277: the other.
! 278:
! 279: HHOOSSTT name[:port] ...
! 280: If no UURRII is specified, the HHOOSSTT parameter specifies a whitespace-
! 281: delimited list of LDAP servers to connect to. Each host may
! 282: include an optional _p_o_r_t separated by a colon (':'). The HHOOSSTT
! 283: parameter is deprecated in favor of the UURRII specification and is
! 284: included for backwards compatibility.
! 285:
! 286: PPOORRTT port_number
! 287: If no UURRII is specified, the PPOORRTT parameter specifies the default
! 288: port to connect to on the LDAP server if a HHOOSSTT parameter does not
! 289: specify the port itself. If no PPOORRTT parameter is used, the default
! 290: is port 389 for LDAP and port 636 for LDAP over TLS (SSL). The
! 291: PPOORRTT parameter is deprecated in favor of the UURRII specification and
! 292: is included for backwards compatibility.
! 293:
! 294: BBIINNDD__TTIIMMEELLIIMMIITT seconds
! 295: The BBIINNDD__TTIIMMEELLIIMMIITT parameter specifies the amount of time, in
! 296: seconds, to wait while trying to connect to an LDAP server. If
! 297: multiple UURRIIs or HHOOSSTTs are specified, this is the amount of time to
! 298: wait before trying the next one in the list.
! 299:
! 300: NNEETTWWOORRKK__TTIIMMEEOOUUTT seconds
! 301: An alias for BBIINNDD__TTIIMMEELLIIMMIITT for OpenLDAP compatibility.
! 302:
! 303: TTIIMMEELLIIMMIITT seconds
! 304: The TTIIMMEELLIIMMIITT parameter specifies the amount of time, in seconds,
! 305: to wait for a response to an LDAP query.
! 306:
! 307: TTIIMMEEOOUUTT seconds
! 308: The TTIIMMEEOOUUTT parameter specifies the amount of time, in seconds, to
! 309: wait for a response from the various LDAP APIs.
! 310:
! 311: SSUUDDOOEERRSS__BBAASSEE base
! 312: The base DN to use when performing ssuuddoo LDAP queries. Typically
! 313: this is of the form ou=SUDOers,dc=example,dc=com for the domain
! 314: example.com. Multiple SSUUDDOOEERRSS__BBAASSEE lines may be specified, in
! 315: which case they are queried in the order specified.
! 316:
! 317: SSUUDDOOEERRSS__SSEEAARRCCHH__FFIILLTTEERR ldap_filter
! 318: An LDAP filter which is used to restrict the set of records
! 319: returned when performing a ssuuddoo LDAP query. Typically, this is of
! 320: the form attribute=value or
! 321: (&(attribute=value)(attribute2=value2)).
! 322:
! 323: SSUUDDOOEERRSS__TTIIMMEEDD on/true/yes/off/false/no
! 324: Whether or not to evaluate the sudoNotBefore and sudoNotAfter
! 325: attributes that implement time-dependent sudoers entries.
! 326:
! 327: SSUUDDOOEERRSS__DDEEBBUUGG debug_level
! 328: This sets the debug level for ssuuddoo LDAP queries. Debugging
! 329: information is printed to the standard error. A value of 1 results
! 330: in a moderate amount of debugging information. A value of 2 shows
! 331: the results of the matches themselves. This parameter should not
! 332: be set in a production environment as the extra information is
! 333: likely to confuse users.
! 334:
! 335: BBIINNDDDDNN DN
! 336: The BBIINNDDDDNN parameter specifies the identity, in the form of a
! 337: Distinguished Name (DN), to use when performing LDAP operations.
! 338: If not specified, LDAP operations are performed with an anonymous
! 339: identity. By default, most LDAP servers will allow anonymous
! 340: access.
! 341:
! 342: BBIINNDDPPWW secret
! 343: The BBIINNDDPPWW parameter specifies the password to use when performing
! 344: LDAP operations. This is typically used in conjunction with the
! 345: BBIINNDDDDNN parameter.
! 346:
! 347: RROOOOTTBBIINNDDDDNN DN
! 348: The RROOOOTTBBIINNDDDDNN parameter specifies the identity, in the form of a
! 349: Distinguished Name (DN), to use when performing privileged LDAP
! 350: operations, such as _s_u_d_o_e_r_s queries. The password corresponding to
! 351: the identity should be stored in _/_e_t_c_/_l_d_a_p_._s_e_c_r_e_t. If not
! 352: specified, the BBIINNDDDDNN identity is used (if any).
! 353:
! 354: LLDDAAPP__VVEERRSSIIOONN number
! 355: The version of the LDAP protocol to use when connecting to the
! 356: server. The default value is protocol version 3.
! 357:
! 358: SSSSLL on/true/yes/off/false/no
! 359: If the SSSSLL parameter is set to on, true or yes, TLS (SSL)
! 360: encryption is always used when communicating with the LDAP server.
! 361: Typically, this involves connecting to the server on port 636
! 362: (ldaps).
! 363:
! 364: SSSSLL start_tls
! 365: If the SSSSLL parameter is set to start_tls, the LDAP server
! 366: connection is initiated normally and TLS encryption is begun before
! 367: the bind credentials are sent. This has the advantage of not
! 368: requiring a dedicated port for encrypted communications. This
! 369: parameter is only supported by LDAP servers that honor the
! 370: start_tls extension, such as the OpenLDAP server.
! 371:
! 372: TTLLSS__CCHHEECCKKPPEEEERR on/true/yes/off/false/no
! 373: If enabled, TTLLSS__CCHHEECCKKPPEEEERR will cause the LDAP server's TLS
! 374: certificated to be verified. If the server's TLS certificate
! 375: cannot be verified (usually because it is signed by an unknown
! 376: certificate authority), ssuuddoo will be unable to connect to it. If
! 377: TTLLSS__CCHHEECCKKPPEEEERR is disabled, no check is made. Note that disabling
! 378: the check creates an opportunity for man-in-the-middle attacks
! 379: since the server's identity will not be authenticated. If
! 380: possible, the CA's certificate should be installed locally so it
! 381: can be verified.
! 382:
! 383: TTLLSS__CCAACCEERRTT file name
! 384: An alias for TTLLSS__CCAACCEERRTTFFIILLEE for OpenLDAP compatibility.
! 385:
! 386: TTLLSS__CCAACCEERRTTFFIILLEE file name
! 387: The path to a certificate authority bundle which contains the
! 388: certificates for all the Certificate Authorities the client knows
! 389: to be valid, e.g. _/_e_t_c_/_s_s_l_/_c_a_-_b_u_n_d_l_e_._p_e_m. This option is only
! 390: supported by the OpenLDAP libraries. Netscape-derived LDAP
! 391: libraries use the same certificate database for CA and client
! 392: certificates (see TTLLSS__CCEERRTT).
! 393:
! 394: TTLLSS__CCAACCEERRTTDDIIRR directory
! 395: Similar to TTLLSS__CCAACCEERRTTFFIILLEE but instead of a file, it is a directory
! 396: containing individual Certificate Authority certificates, e.g.
! 397: _/_e_t_c_/_s_s_l_/_c_e_r_t_s. The directory specified by TTLLSS__CCAACCEERRTTDDIIRR is
! 398: checked after TTLLSS__CCAACCEERRTTFFIILLEE. This option is only supported by the
! 399: OpenLDAP libraries.
! 400:
! 401: TTLLSS__CCEERRTT file name
! 402: The path to a file containing the client certificate which can be
! 403: used to authenticate the client to the LDAP server. The
! 404: certificate type depends on the LDAP libraries used.
! 405:
! 406: OpenLDAP:
! 407: tls_cert /etc/ssl/client_cert.pem
! 408:
! 409: Netscape-derived:
! 410: tls_cert /var/ldap/cert7.db
! 411:
! 412: When using Netscape-derived libraries, this file may also contain
! 413: Certificate Authority certificates.
! 414:
! 415: TTLLSS__KKEEYY file name
! 416: The path to a file containing the private key which matches the
! 417: certificate specified by TTLLSS__CCEERRTT. The private key must not be
! 418: password-protected. The key type depends on the LDAP libraries
! 419: used.
! 420:
! 421: OpenLDAP:
! 422: tls_key /etc/ssl/client_key.pem
! 423:
! 424: Netscape-derived:
! 425: tls_key /var/ldap/key3.db
! 426:
! 427: TTLLSS__RRAANNDDFFIILLEE file name
! 428: The TTLLSS__RRAANNDDFFIILLEE parameter specifies the path to an entropy source
! 429: for systems that lack a random device. It is generally used in
! 430: conjunction with _p_r_n_g_d or _e_g_d. This option is only supported by
! 431: the OpenLDAP libraries.
! 432:
! 433: TTLLSS__CCIIPPHHEERRSS cipher list
! 434: The TTLLSS__CCIIPPHHEERRSS parameter allows the administer to restrict which
! 435: encryption algorithms may be used for TLS (SSL) connections. See
! 436: the OpenSSL manual for a list of valid ciphers. This option is
! 437: only supported by the OpenLDAP libraries.
! 438:
! 439: UUSSEE__SSAASSLL on/true/yes/off/false/no
! 440: Enable UUSSEE__SSAASSLL for LDAP servers that support SASL authentication.
! 441:
! 442: SSAASSLL__AAUUTTHH__IIDD identity
! 443: The SASL user name to use when connecting to the LDAP server. By
! 444: default, ssuuddoo will use an anonymous connection.
! 445:
! 446: RROOOOTTUUSSEE__SSAASSLL on/true/yes/off/false/no
! 447: Enable RROOOOTTUUSSEE__SSAASSLL to enable SASL authentication when connecting
! 448: to an LDAP server from a privileged process, such as ssuuddoo.
! 449:
! 450: RROOOOTTSSAASSLL__AAUUTTHH__IIDD identity
! 451: The SASL user name to use when RROOOOTTUUSSEE__SSAASSLL is enabled.
! 452:
! 453: SSAASSLL__SSEECCPPRROOPPSS none/properties
! 454: SASL security properties or _n_o_n_e for no properties. See the SASL
! 455: programmer's manual for details.
! 456:
! 457: KKRRBB55__CCCCNNAAMMEE file name
! 458: The path to the Kerberos 5 credential cache to use when
! 459: authenticating with the remote server.
! 460:
! 461: DDEERREEFF never/searching/finding/always
! 462: How alias dereferencing is to be performed when searching. See the
! 463: _l_d_a_p_._c_o_n_f(4) manual for a full description of this option.
! 464:
! 465: See the ldap.conf entry in the EXAMPLES section.
! 466:
! 467: CCoonnffiigguurriinngg nnsssswwiittcchh..ccoonnff
! 468: Unless it is disabled at build time, ssuuddoo consults the Name Service
! 469: Switch file, _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f, to specify the _s_u_d_o_e_r_s search order.
! 470: Sudo looks for a line beginning with sudoers: and uses this to
! 471: determine the search order. Note that ssuuddoo does not stop searching
! 472: after the first match and later matches take precedence over earlier
! 473: ones.
! 474:
! 475: The following sources are recognized:
! 476:
! 477: files read sudoers from F</etc/sudoers>
! 478: ldap read sudoers from LDAP
! 479:
! 480: In addition, the entry [NOTFOUND=return] will short-circuit the search
! 481: if the user was not found in the preceding source.
! 482:
! 483: To consult LDAP first followed by the local sudoers file (if it
! 484: exists), use:
! 485:
! 486: sudoers: ldap files
! 487:
! 488: The local _s_u_d_o_e_r_s file can be ignored completely by using:
! 489:
! 490: sudoers: ldap
! 491:
! 492: If the _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f file is not present or there is no sudoers
! 493: line, the following default is assumed:
! 494:
! 495: sudoers: files
! 496:
! 497: Note that _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f is supported even when the underlying
! 498: operating system does not use an nsswitch.conf file.
! 499:
! 500: CCoonnffiigguurriinngg nneettssvvcc..ccoonnff
! 501: On AIX systems, the _/_e_t_c_/_n_e_t_s_v_c_._c_o_n_f file is consulted instead of
! 502: _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f. ssuuddoo simply treats _n_e_t_s_v_c_._c_o_n_f as a variant of
! 503: _n_s_s_w_i_t_c_h_._c_o_n_f; information in the previous section unrelated to the
! 504: file format itself still applies.
! 505:
! 506: To consult LDAP first followed by the local sudoers file (if it
! 507: exists), use:
! 508:
! 509: sudoers = ldap, files
! 510:
! 511: The local _s_u_d_o_e_r_s file can be ignored completely by using:
! 512:
! 513: sudoers = ldap
! 514:
! 515: To treat LDAP as authoratative and only use the local sudoers file if
! 516: the user is not present in LDAP, use:
! 517:
! 518: sudoers = ldap = auth, files
! 519:
! 520: Note that in the above example, the auth qualfier only affects user
! 521: lookups; both LDAP and _s_u_d_o_e_r_s will be queried for Defaults entries.
! 522:
! 523: If the _/_e_t_c_/_n_e_t_s_v_c_._c_o_n_f file is not present or there is no sudoers
! 524: line, the following default is assumed:
! 525:
! 526: sudoers = files
! 527:
! 528: FFIILLEESS
! 529: _/_e_t_c_/_l_d_a_p_._c_o_n_f LDAP configuration file
! 530:
! 531: _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f determines sudoers source order
! 532:
! 533: _/_e_t_c_/_n_e_t_s_v_c_._c_o_n_f determines sudoers source order on AIX
! 534:
! 535: EEXXAAMMPPLLEESS
! 536: EExxaammppllee llddaapp..ccoonnff
! 537: # Either specify one or more URIs or one or more host:port pairs.
! 538: # If neither is specified sudo will default to localhost, port 389.
! 539: #
! 540: #host ldapserver
! 541: #host ldapserver1 ldapserver2:390
! 542: #
! 543: # Default port if host is specified without one, defaults to 389.
! 544: #port 389
! 545: #
! 546: # URI will override the host and port settings.
! 547: uri ldap://ldapserver
! 548: #uri ldaps://secureldapserver
! 549: #uri ldaps://secureldapserver ldap://ldapserver
! 550: #
! 551: # The amount of time, in seconds, to wait while trying to connect to
! 552: # an LDAP server.
! 553: bind_timelimit 30
! 554: #
! 555: # The amount of time, in seconds, to wait while performing an LDAP query.
! 556: timelimit 30
! 557: #
! 558: # Must be set or sudo will ignore LDAP; may be specified multiple times.
! 559: sudoers_base ou=SUDOers,dc=example,dc=com
! 560: #
! 561: # verbose sudoers matching from ldap
! 562: #sudoers_debug 2
! 563: #
! 564: # Enable support for time-based entries in sudoers.
! 565: #sudoers_timed yes
! 566: #
! 567: # optional proxy credentials
! 568: #binddn <who to search as>
! 569: #bindpw <password>
! 570: #rootbinddn <who to search as, uses /etc/ldap.secret for bindpw>
! 571: #
! 572: # LDAP protocol version, defaults to 3
! 573: #ldap_version 3
! 574: #
! 575: # Define if you want to use an encrypted LDAP connection.
! 576: # Typically, you must also set the port to 636 (ldaps).
! 577: #ssl on
! 578: #
! 579: # Define if you want to use port 389 and switch to
! 580: # encryption before the bind credentials are sent.
! 581: # Only supported by LDAP servers that support the start_tls
! 582: # extension such as OpenLDAP.
! 583: #ssl start_tls
! 584: #
! 585: # Additional TLS options follow that allow tweaking of the
! 586: # SSL/TLS connection.
! 587: #
! 588: #tls_checkpeer yes # verify server SSL certificate
! 589: #tls_checkpeer no # ignore server SSL certificate
! 590: #
! 591: # If you enable tls_checkpeer, specify either tls_cacertfile
! 592: # or tls_cacertdir. Only supported when using OpenLDAP.
! 593: #
! 594: #tls_cacertfile /etc/certs/trusted_signers.pem
! 595: #tls_cacertdir /etc/certs
! 596: #
! 597: # For systems that don't have /dev/random
! 598: # use this along with PRNGD or EGD.pl to seed the
! 599: # random number pool to generate cryptographic session keys.
! 600: # Only supported when using OpenLDAP.
! 601: #
! 602: #tls_randfile /etc/egd-pool
! 603: #
! 604: # You may restrict which ciphers are used. Consult your SSL
! 605: # documentation for which options go here.
! 606: # Only supported when using OpenLDAP.
! 607: #
! 608: #tls_ciphers <cipher-list>
! 609: #
! 610: # Sudo can provide a client certificate when communicating to
! 611: # the LDAP server.
! 612: # Tips:
! 613: # * Enable both lines at the same time.
! 614: # * Do not password protect the key file.
! 615: # * Ensure the keyfile is only readable by root.
! 616: #
! 617: # For OpenLDAP:
! 618: #tls_cert /etc/certs/client_cert.pem
! 619: #tls_key /etc/certs/client_key.pem
! 620: #
! 621: # For SunONE or iPlanet LDAP, tls_cert and tls_key may specify either
! 622: # a directory, in which case the files in the directory must have the
! 623: # default names (e.g. cert8.db and key4.db), or the path to the cert
! 624: # and key files themselves. However, a bug in version 5.0 of the LDAP
! 625: # SDK will prevent specific file names from working. For this reason
! 626: # it is suggested that tls_cert and tls_key be set to a directory,
! 627: # not a file name.
! 628: #
! 629: # The certificate database specified by tls_cert may contain CA certs
! 630: # and/or the client's cert. If the client's cert is included, tls_key
! 631: # should be specified as well.
! 632: # For backward compatibility, "sslpath" may be used in place of tls_cert.
! 633: #tls_cert /var/ldap
! 634: #tls_key /var/ldap
! 635: #
! 636: # If using SASL authentication for LDAP (OpenSSL)
! 637: # use_sasl yes
! 638: # sasl_auth_id <SASL user name>
! 639: # rootuse_sasl yes
! 640: # rootsasl_auth_id <SASL user name for root access>
! 641: # sasl_secprops none
! 642: # krb5_ccname /etc/.ldapcache
! 643:
! 644: SSuuddoo sscchheemmaa ffoorr OOppeennLLDDAAPP
! 645: The following schema, in OpenLDAP format, is included with ssuuddoo source
! 646: and binary distributions as _s_c_h_e_m_a_._O_p_e_n_L_D_A_P. Simply copy it to the
! 647: schema directory (e.g. _/_e_t_c_/_o_p_e_n_l_d_a_p_/_s_c_h_e_m_a), add the proper include
! 648: line in slapd.conf and restart ssllaappdd.
! 649:
! 650: attributetype ( 1.3.6.1.4.1.15953.9.1.1
! 651: NAME 'sudoUser'
! 652: DESC 'User(s) who may run sudo'
! 653: EQUALITY caseExactIA5Match
! 654: SUBSTR caseExactIA5SubstringsMatch
! 655: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 656:
! 657: attributetype ( 1.3.6.1.4.1.15953.9.1.2
! 658: NAME 'sudoHost'
! 659: DESC 'Host(s) who may run sudo'
! 660: EQUALITY caseExactIA5Match
! 661: SUBSTR caseExactIA5SubstringsMatch
! 662: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 663:
! 664: attributetype ( 1.3.6.1.4.1.15953.9.1.3
! 665: NAME 'sudoCommand'
! 666: DESC 'Command(s) to be executed by sudo'
! 667: EQUALITY caseExactIA5Match
! 668: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 669:
! 670: attributetype ( 1.3.6.1.4.1.15953.9.1.4
! 671: NAME 'sudoRunAs'
! 672: DESC 'User(s) impersonated by sudo'
! 673: EQUALITY caseExactIA5Match
! 674: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 675:
! 676: attributetype ( 1.3.6.1.4.1.15953.9.1.5
! 677: NAME 'sudoOption'
! 678: DESC 'Options(s) followed by sudo'
! 679: EQUALITY caseExactIA5Match
! 680: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 681:
! 682: attributetype ( 1.3.6.1.4.1.15953.9.1.6
! 683: NAME 'sudoRunAsUser'
! 684: DESC 'User(s) impersonated by sudo'
! 685: EQUALITY caseExactIA5Match
! 686: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 687:
! 688: attributetype ( 1.3.6.1.4.1.15953.9.1.7
! 689: NAME 'sudoRunAsGroup'
! 690: DESC 'Group(s) impersonated by sudo'
! 691: EQUALITY caseExactIA5Match
! 692: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 693:
! 694: attributetype ( 1.3.6.1.4.1.15953.9.1.8
! 695: NAME 'sudoNotBefore'
! 696: DESC 'Start of time interval for which the entry is valid'
! 697: EQUALITY generalizedTimeMatch
! 698: ORDERING generalizedTimeOrderingMatch
! 699: SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
! 700:
! 701: attributetype ( 1.3.6.1.4.1.15953.9.1.9
! 702: NAME 'sudoNotAfter'
! 703: DESC 'End of time interval for which the entry is valid'
! 704: EQUALITY generalizedTimeMatch
! 705: ORDERING generalizedTimeOrderingMatch
! 706: SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
! 707:
! 708: attributeTypes ( 1.3.6.1.4.1.15953.9.1.10
! 709: NAME 'sudoOrder'
! 710: DESC 'an integer to order the sudoRole entries'
! 711: EQUALITY integerMatch
! 712: ORDERING integerOrderingMatch
! 713: SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
! 714:
! 715: objectclass ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL
! 716: DESC 'Sudoer Entries'
! 717: MUST ( cn )
! 718: MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $
! 719: sudoRunAsGroup $ sudoOption $ sudoNotBefore $ sudoNotAfter $
! 720: sudoOrder $ description )
! 721: )
! 722:
! 723: SSEEEE AALLSSOO
! 724: _l_d_a_p_._c_o_n_f(4), _s_u_d_o_e_r_s(4)
! 725:
! 726: CCAAVVEEAATTSS
! 727: Note that there are differences in the way that LDAP-based _s_u_d_o_e_r_s is
! 728: parsed compared to file-based _s_u_d_o_e_r_s. See the "Differences between
! 729: LDAP and non-LDAP sudoers" section for more information.
! 730:
! 731: BBUUGGSS
! 732: If you feel you have found a bug in ssuuddoo, please submit a bug report at
! 733: http://www.sudo.ws/sudo/bugs/
! 734:
! 735: SSUUPPPPOORRTT
! 736: Limited free support is available via the sudo-users mailing list, see
! 737: http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
! 738: the archives.
! 739:
! 740: DDIISSCCLLAAIIMMEERR
! 741: ssuuddoo is provided ``AS IS'' and any express or implied warranties,
! 742: including, but not limited to, the implied warranties of
! 743: merchantability and fitness for a particular purpose are disclaimed.
! 744: See the LICENSE file distributed with ssuuddoo or
! 745: http://www.sudo.ws/sudo/license.html for complete details.
! 746:
! 747:
! 748:
! 749: 1.8.3 September 16, 2011 SUDOERS.LDAP(4)
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoers.ldap.cat CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc