Allow AD Groups to SUDO
Solution 1
Several months after you asked but the correct answer is that you remove all domain information from the group. All the information is set and extracted by SSSD automatically.
The only flaw I see in some of your examples is that you escaped the space with a ^.
An AD group of Enterprise Admins
would have a sudoers line that starts with
%Enterprise\ Admins
For example, if your domain is example.com
, then the sudoers line looks like
%Enterprise\ [email protected] ALL=(ALL) ALL
You can verify this by looking calling getent on the group.
getent group Enterprise\ Admins
Solution 2
winbind
and sssd
import the AD groups in an equivalent manner to NIS netgroups. So your group definitions in the /etc/sudoers
file need to start with +
and not %
. Furthermore, names containing spaces should either be double-quoted, or each space specified as \x20
.
%sudo ALL = (ALL) ALL
+"domain users" ALL = (ALL) ALL
+domain\x20admins ALL = (ALL) NOPASSWD: ALL
Related videos on Youtube
SnakeDoc
Updated on September 18, 2022Comments
-
SnakeDoc over 1 year
I'm adding some Fedora 20 workstations to our Windows 2003 domain. I've successfully joined the domain with the boxes, and can login with domain accounts.
Now I'm trying to allow the default AD group
Enterprise Admins
to useSUDO
, however whatever I do, it seems that the group cannot be found (or at least it tells me my user account is not in the sudoers file)Structure of the OU (default really):
- mydomain.local
- Builtin
- Computers
- DCOM-Users
- DOmain Controllers
- ForeignSecurityPrincipals
- CompanyName
- Management
- Accounting
- Admins
- SysAccounts
- CustomerService
- Warehouse
- Users
I used
realmd
andsssd
to join the domain, and am trying to allow sudo to groups located under theUsers
OU, but would also like to add some from theCompanyName --> Admins
OU/Sub-group as well.I'm currently trying this with no luck (in /etc/sudoers)
%MYDOMAIN\\Enterprise^Admins ALL=(ALL) ALL
I've also tried variations as well, such as:
%MYDOMAIN\\Users\Enterprise^Admins ALL=(ALL) ALL %Enterprise^[email protected] ALL=(ALL) ALL
etc... nothing seems to be working. Even after reboots, and/or
systemctrl restart sssd
.If i explicitly add my domain account to the /etc/sudoers file, it works no problem.
[email protected] ALL=(ALL) ALL
There are a few resources that seem to indicate it should be possible to add AD groups to sudoers, however so far none of them have worked for me:
http://funwithlinux.net/2013/09/join-fedora-19-to-active-directory-domain-realmd/
https://serverfault.com/questions/387950/how-to-map-ad-domain-admins-group-to-ubuntu-admins
- mydomain.local
-
SnakeDoc over 9 yearshmm, things like this: funwithlinux.net/2013/09/… and serverfault.com/questions/387950/… and help.ubuntu.com/community/LikewiseOpen seem to hint that it may be possible -- however so far I haven't been able to get it to work?
-
text over 9 yearsThe last 2 references you provide uses the commercial Likewise package.
-
Georgyo almost 9 yearsI can verify that
%
also works. -
roaima almost 9 years@Georgyo thank you for that interesting update. When I started off with AD integration there was most definitely a difference between
%
and+
. Perhaps they have merged over time and versions. I'll see if I can get time to revisit this on our newer systems here. -
Oskar Berggren about 7 yearsOn Fedora 25 with its defaullt AD client setup I had to also specify the domain name, e.g: %domain\ [email protected]