search

sudo-project / sudo

Utility to execute a command as another user
https://www.sudo.ws
Other
1.2k stars 224 forks source link

Sudo LDAP stopped working in 1.9.15 #325

Closed mmelvin0 closed 1 year ago

mmelvin0 commented 1 year ago

Sudo LDAP was working for me with 1.9.14.p3, but broke with 1.9.15 on my setup and I haven't been able to determine why.

When I do sudo -ll with SUDOERS_DEBUG 2 in 1.9.14.p3 I get LDAP debug output indicating the correct things are happening, but with 1.9.15 there's no LDAP debug output at all. I simply get a password prompt followed by "not in sudoers file" and no indication LDAP is being queried. Reverting to 1.9.14.p3 restores the expected behavior.

I'm not sure if this is an Arch packaging issue, sudo regression, or config issue on my end. Here's my relevant configs and LDAP objects. Please let me know if more info is needed to diagnose.

/etc/nsswitch.conf:

# ...
sudoers: files ldap
# ...

(I tried swapping ldap and files but same result, and I prefer it checks local first anyway.)

/etc/sudo.conf:

Plugin sudoers_policy sudoers.so
Plugin sudoers_io sudoers.so
Plugin sudoers_audit sudoers.so ldap_secret=/path/to/ldap-password

(That's the entirety of sudo.conf and I must admit I don't fully understand it but it worked for me in < 1.9.15.)

/etc/openldap/ldap.conf:

URI ldapi://%2frun%2fopenldap%2fslapd.sock
BASE o=home
ROOTBINDDN cn=sudo,ou=roles,o=home
SUDOERS_BASE o=home
SUDOERS_DEBUG 2

(Perhaps sudo is looking for ldap.conf in a different place now? I'm not sure how to figure out where it checks but if that's the case it could be a packaging issue...)

LDAP Group:

dn: cn=super-sudo,ou=groups,o=home
objectClass: groupOfMembers
objectClass: posixGroup
cn: super-sudo
gidNumber: 90000
member: uid=mike,ou=users,o=home

LDAP Sudo Role:

dn: cn=super-sudo,ou=sudoers,o=home
objectClass: sudoRole
cn: super-sudo
sudoCommand: ALL
sudoHost: ALL
sudoOption: !authenticate
sudoRunAsGroup: ALL
sudoRunAsUser: ALL
sudoUser: %super-sudo
millert commented 1 year ago

I'm able to reproduce the problem. As a workaround you can edit /etc/sudo.conf to be:

Plugin sudoers_policy sudoers.so
Plugin sudoers_io sudoers.so
Plugin sudoers_audit sudoers.so ldap_conf=/etc/ldap.conf ldap_secret=/path/to/ldap-password

replacing /etc/ldap.conf with where your ldap.conf file is located.

millert commented 1 year ago

This is fixed by sudo 1.9.15p1, available now.