Configuring OpenLDAP-based sudo Authentication
Introduction
sudo is an application that allows a regular Linux user to obtain root or administrator permissions. sudo can be configured in multiple ways. You can set up a sudo on a local computer or server, or set up a centralized sudo via third-party software. In this section, an OpenLDAP server is used to set up a centralized sudo. In this way, you can manage users and sudo permissions centrally on the OpenLDAP server to allow faster installation on the client side. Any SSSD service on the client configured with a sudo authentication source allows OpenLDAP users to execute sudo.
Prerequisites
A local yum repository has been configured. For details, see Configuring an HCE Repository.
- The OpenLDAP server and client have been deployed.
- The SSSD service has been installed and configured on the client.
Procedure
- Switch SELinux from the Enforcing to Permissive mode to prevent SELinux policies from blocking OpenLDAP user login or sudo login.
Check the SELinux mode. If Enforcing is returned, the mode needs to be switched.
getenforce
Switch SELinux from Enforcing to Permissive mode.
setenforce 0
- Import the sudo schema to the OpenLDAP server.
- Create the /etc/openldap/schema/sudo.schema file on the OpenLDAP server and write the following content to the file:
# OpenLDAP schema file for Sudo # Save as /etc/openldap/schema/sudo.schema and restart slapd. # For a version that uses online configuration, see schema.olcSudo. # attributetype ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo (deprecated)' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Group(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.8 NAME 'sudoNotBefore' DESC 'Start of time interval for which the entry is valid' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) attributetype ( 1.3.6.1.4.1.15953.9.1.9 NAME 'sudoNotAfter' DESC 'End of time interval for which the entry is valid' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) attributetype ( 1.3.6.1.4.1.15953.9.1.10 NAME 'sudoOrder' DESC 'an integer to order the sudoRole entries' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) objectclass ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL DESC 'Sudoer Entries' MUST ( cn ) MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoOrder $ sudoNotBefore $ sudoNotAfter $ description ) )The preceding content defines attributes similar to those in the /etc/sudoers file to manage sudo permissions in the system.
- Create a conversion configuration file.
cat > ./schema_conv.conf << EOL include /etc/openldap/schema/sudo.schema EOL
- Convert the schema into an LDIF file.
mkdir /tmp/ldif slaptest -f ./schema_conv.conf -F /tmp/ldif/
- Copy the LDIF file to the schema directory.
cp /tmp/ldif/cn\=config/cn\=schema/cn\=\{0\}sudo.ldif /etc/openldap/schema/sudo.ldif - Open sudo.ldif and change the values of dn and cn, as shown in the following figure.
Delete the following lines at the end of the file (the line content is for reference only):structuralObjectClass: olcSchemaConfig entryUUID: b1d84e62-d5fa-103f-92ae-45f3b9c81bd2 creatorsName: cn=config createTimestamp: 20250605014651Z entryCSN: 20250605014651.004275Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20250605014651Z
- Modify the file permissions.
chown ldap:ldap /etc/openldap/schema/sudo.ldif
- Import the schema to OpenLDAP so that sudo can be configured via OpenLDAP.
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/sudo.ldif systemctl restart slapd
- Create the /etc/openldap/schema/sudo.schema file on the OpenLDAP server and write the following content to the file:
- Create an organizational unit sudoers.
- On the OpenLDAP client, create the sudoers.ldif file and write the content below into the file.
dc=huawei is an example only. You can change it to another name, such as your_company, based on service requirements.
dn: ou=sudoers,dc=huawei,dc=com objectClass: organizationalUnit objectClass: top ou: sudo description: Default ou for SUDO dn: cn=defaults,ou=sudoers,dc=huawei,dc=com objectClass: sudoRole objectClass: top cn: defaults sudoHost: ALL sudoOption: secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
An organizational unit sudoers will be created, with default settings.
The domain name and default sudo settings are examples only. You can modify the file content as needed.
- Add sudoers settings to the OpenLDAP server.
ldapadd -x -D cn=root,dc=huawei,dc=com -W -f sudoers.ldif
Change the administrator account in the command based on the actual OpenLDAP deployment.
- On the OpenLDAP client, create the sudoers.ldif file and write the content below into the file.
- On the OpenLDAP server, add an OpenLDAP user to the sudoers organizational unit.
- To add an existing OpenLDAP user (for example, test1) to sudoers, create the user_add.ldif file and write the following content into the file:
dn: cn=test1,ou=sudoers,dc=huawei,dc=com objectClass: sudoRole objectClass: top cn: test1 sudoCommand: ALL sudoHost: ALL sudoRunAsUser: ALL sudoUser: test1
To add a new OpenLDAP user (for example, test2) to sudoers by default when the user is created, create the user_add.ldif file and write the following content into the file:dn: uid=test2,ou=People,dc=huawei,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: test2 sn: temp userPassword: {SSHA}cDG5NuQd+rYn6rWh1r5UnysUOwJlt1uk loginShell: /bin/bash uidNumber: 2000 gidNumber: 2000 homeDirectory: /home/test2 shadowExpire:99999 shadowLastChange: 9999999 shadowMax: 99999 shadowWarning: 7 dn: cn=test2,ou=Group, dc=huawei,dc=com objectClass: posixGroup cn: test2 gidNumber: 2000 memberUid: test2 dn: cn=test2,ou=sudoers, dc=huawei,dc=com objectClass: sudoRole objectClass: top cn: test2 sudoCommand: ALL sudoHost: ALL sudoRunAsUser: ALL sudoUser: test2 Change the home directory, username, uidNumber, gidNumber, userPassword, sudo configuration items, and other information as needed. You can run slappasswd to generate a value for userPassword.
- Add configurations to the OpenLDAP server.
ldapadd -x -D cn=root,dc=huawei,dc=com -W -f user_add.ldif
- To add an existing OpenLDAP user (for example, test1) to sudoers, create the user_add.ldif file and write the following content into the file:
- Configure the client.
- Add the following configuration to /etc/nsswitch.conf so that the SSSD service can manage sudoers configurations:
sudoers: files sss
Result:
- Modify the following information in bold in the /etc/sssd/sssd.conf file (you can choose to modify the non-bold text or not):
[domain/ldap] enumerate= False ldap_schema = rfc2307bis autofs_provider = ldap cache_credentials = False ldap_search_base = dc=huawei,dc=com id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_sudo_search_base = ou=sudoers,dc=huawei,dc=com sudo_provider = ldap ldap_uri = ldaps://huawei.com ldap_tls_reqcert = allow ldap_tls_cacertdir = /etc/openldap/ssl ldap_search_timeout = 90 ldap_network_timeout = 90 timeout = 30 ldap_id_use_start_tls = false [sssd] services = nss, pam, sudo domains = ldap [nss] homedir_substring = /home
Result:
Modify [domain/ldap] and fields such as domains in [sssd] as needed.
- Clear the SSSD cache and restart the SSSD service.
systemctl stop sssd sss_cache -E systemctl restart sssd
- Add the following configuration to /etc/nsswitch.conf so that the SSSD service can manage sudoers configurations:
- Verify sudo commands.
- Log in using an OpenLDAP user (for example, test1) and run sudo -l. Expected result:
If HCE functions as the OpenLDAP client and Rocky Linux as the OpenLDAP server, you need to continue with the subsequent steps.
- Log in using an OpenLDAP user (for example, test1) and run sudo -l. Expected result:
- Overwrite the /etc/sssd/sssd.conf file of the OpenLDAP client with the content below.
Back up the /etc/sssd/sssd.conf file before modifying it.
[domain/ldap] enumerate = false ldap_schema = rfc2307bis autofs_provider = ldap cache_credentials = True ldap_search_base = dc=huawei,dc=com id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_sudo_search_base = ou=sudoers,dc=huawei,dc=com sudo_provider = ldap ldap_uri = ldap://192.168.122.254:389 ldap_tls_reqcert = allow ldap_tls_cacertdir = /etc/openldap/cacerts ldap_search_timeout = 90 ldap_network_timeout = 90 ldap_id_use_start_tls = false access_provider = ldap debug_level = 9 ldap_default_bind_dn = cn=root,dc=huawei,dc=com ldap_default_authtok_type = password ldap_default_authtok = 123456 # ldap_sudo_filter = (objectClass=sudoRole) use_fully_qualified_names = false debug_level = 9 [sssd] services = nss, pam, sudo domains = ldap timeout = 30 [nss] homedir_substring = /home filter_groups = root filter_users = root
The value of domains must be the same as xxx in [domain/xxx]. After modifying the /etc/sssd/sssd.conf file and saving it, restart the SSSD service.chmod 600 /etc/sssd/sssd.conf systemctl stop sssd sss_cache -E systemctl start sssd systemctl enable sssd systemctl status sssd
Check whether there are SSSD errors and whether the /etc/sssd/sssd.conf file is correct.tail /var/log/sssd/sssd.log
- Modify the /etc/nsswitch.conf file of the OpenLDAP client.
sudoers: files sss must be contained in the /etc/nsswitch.conf file, indicating that sudo rules are read first from /etc/sudoers and then from SSSD cache. passwd and group must contain sss.
/etc/nsswitch.conf cannot be manually modified using vim because the modification will be invalid because authselect is used.
Modify /etc/nsswitch.conf as follows.
Back up the /etc/nsswitch.conf file before modifying it.
# Check the authselect status. authselect current # Expected result: # Profile ID: sssd # Enabled features: # - with-sudo # authselect is used. Your manual modification may become invalid. # (Optional) If with-sudo is not displayed and No existing configuration detected. is returned, enable sudo. Run the following command to forcibly select the profile and enable sudo: authselect select sssd with-sudo --force # Check the authselect status again. authselect current # (Optional) List available authselect features to check whether with-sudo is included. authselect list-features # (Optional) Enable sudo (which may fail). If an error is displayed indicating there are unexpected changes to the configuration, /etc/nsswitch.conf is manually modified. authselect enable-feature with-sudo # (Optional) Restore the default nsswitch.conf (if it is overwritten). cp /usr/share/authselect/default/sssd/nsswitch.conf /etc/nsswitch.conf # Apply the modifications. authselect apply-changes # Restart the SSSD service and clear the cache. systemctl restart sssd sss_cache -E # Check whether sudo is enabled. authselect current | grep with-sudo # (Optional) If no, run the following command immediately: authselect enable-feature with-sudo # Reload authselect apply-changes # Restart the SSSD service and clear the cache. systemctl restart sssd sss_cache -E # Check whether /etc/nsswitch.conf, /etc/pam.d/system-auth, and /etc/pam.d/password-auth are overwritten.
After modifying and saving the file, the content is as follows.
- Modify the /etc/pam.d/system-auth file of the OpenLDAP client.
The /etc/pam.d/system-auth file of the HCE OpenLDAP client references the library file pam_ldap.so.
Modify the /etc/pam.d/system-auth file as follows. Back up the /etc/pam.d/system-auth file before modifying it.
#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth sufficient pam_fprintd.so auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so nullok try_first_pass auth sufficient pam_ldap.so use_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success account required pam_oddjob_mkhomedir.so umask=0077 auth sufficient pam_ldap.so forward_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so account required pam_oddjob_mkhomedir.so umask=0077 password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so md5 shadow nis nullok try_first_pass use_authtok password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session optional pam_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so
After modifying and saving the file, the content is as follows.
- Modify the /etc/pam.d/password-auth file of the OpenLDAP client.
The /etc/pam.d/password-auth file of the HCE OpenLDAP client references the library file pam_ldap.so.
Modify the /etc/pam.d/password-auth file as follows. Back up the /etc/pam.d/password-auth file before modifying it.
#%PAM-1.0 # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=300 auth sufficient pam_unix.so nullok try_first_pass -auth sufficient pam_ldap.so use_first_pass auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=300 auth sufficient pam_faillock.so authsucc audit deny=3 even_deny_root unlock_time=300 auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet -account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_pwquality.so minlen=8 minclass=3 enforce_for_root try_first_pass local_users_only retry=3 dcredit=0 ucredit=0 lcredit=0 ocredit=0 password required pam_pwhistory.so use_authtok remember=5 enforce_for_root password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok -password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so -session optional pam_ldap.so
After modifying and saving the file, the content is as follows.
- Modify the /etc/hosts file of the OpenLDAP client.
Add host information of the OpenLDAP server and information about the local OpenLDAP client.
Example: echo '192.168.122.254 ldap01.huawei.com' >> /etc/hosts
The following figure shows the example result.
- Modify the /etc/hosts file of the OpenLDAP server.
Add host information of the OpenLDAP server. In the following figure, ldap01 is the VM that functions as the OpenLDAP server.
- Check or modify the /etc/pam.d/sudo file of the OpenLDAP client as follows:
#%PAM-1.0 auth include system-auth account include system-auth password include system-auth session include system-auth
- Ensure that the nslcd process is running on the OpenLDAP client.
When HCE functions as the OpenLDAP client, ensure that nslcd is enabled.
systemctl status nslcd
- Stop the nscd service on the OpenLDAP client.
This is an optional operation. You can choose to stop it or not.
Stops the nscd service.
systemctl stop nscd
Prevent the nscd service from starting automatically at boot.
systemctl disable nscd
What is your overall rating for this page?
Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
