Hi all, I configured sudo in order to use LDAP and set the corrisponding defaults on the DIT set to ignore_local_sudoers. After populating the DIT with the rules, sudo works perfectly but I have a problem with the list options of sudo (-l).
It seems like sudo -l for NORMAL users (i.e. not root) doesn't print the corresponding matched rule when this comes from LDAP. More exactly it matches the rule (and actually the user can perform the commands he is enabled to do) BUT they are not shown with the list option. After setting the sudoers_debug to 2 in /etc/ldap.sonf.sudo I obtain the following: gia...@athena ~ $ sudo -l LDAP Config Summary =================== host vesta.homenet.telecomitalia.it port -1 ldap_version 3 sudoers_base ou=sudoers,dc=gabbiani,dc=org binddn (anonymous) bindpw (anonymous) ssl (no) =================== sudo: ldap_create() sudo: ldap_set_option(LDAP_OPT_HOST_NAME, vesta.homenet.telecomitalia.it) sudo: ldap_set_option: debug -> 0 sudo: ldap_set_option: ldap_version -> 3 sudo: ldap_sasl_bind_s() ok sudo: found:cn=defaults,ou=SUDOers,dc=gabbiani,dc=org sudo: ldap sudoOption: 'ignore_local_sudoers' sudo: ldap sudoHost 'ALL' ... MATCH! sudo: ldap sudoOption: '!authenticate' sudo: user_matches=1 sudo: host_matches=1 sudo: sudo_ldap_lookup(52)=0x02 Runas and Command-specific defaults for giampa: sudo: ldap search '(|(sudoUser=giampa)(sudoUser=%giampa)(sudoUser=%wheel) (sudoUser=%floppy)(sudoUser=%audio)(sudoUser=%cdrom)(sudoUser=%video) (sudoUser=%usb)(sudoUser=%portage)(sudoUser=%plugdev)(sudoUser=%netusers) (sudoUser=%cvsadmin)(sudoUser=ALL))' sudo: ldap sudoHost 'ALL' ... MATCH! sudo: ldap search 'sudoUser=+*' The root user instead correctly prints the list informations: athena ~ # sudo -l LDAP Config Summary =================== host vesta.homenet.telecomitalia.it port -1 ldap_version 3 sudoers_base ou=sudoers,dc=gabbiani,dc=org binddn (anonymous) bindpw (anonymous) ssl (no) =================== sudo: ldap_create() sudo: ldap_set_option(LDAP_OPT_HOST_NAME, vesta.homenet.telecomitalia.it) sudo: ldap_set_option: debug -> 0 sudo: ldap_set_option: ldap_version -> 3 sudo: ldap_sasl_bind_s() ok sudo: found:cn=defaults,ou=SUDOers,dc=gabbiani,dc=org sudo: ldap sudoOption: 'ignore_local_sudoers' sudo: ldap sudoHost 'ALL' ... MATCH! sudo: user_matches=1 sudo: host_matches=1 sudo: sudo_ldap_lookup(52)=0x02 Runas and Command-specific defaults for root: sudo: ldap search '(|(sudoUser=root)(sudoUser=%root)(sudoUser=%bin) (sudoUser=%daemon)(sudoUser=%sys)(sudoUser=%adm)(sudoUser=%disk) (sudoUser=%wheel)(sudoUser=%floppy)(sudoUser=%dialout)(sudoUser=%tape) (sudoUser=%video)(sudoUser=ALL))' sudo: ldap sudoHost 'ALL' ... MATCH! sudo: ldap sudoHost 'ALL' ... MATCH! sudo: ldap search 'sudoUser=+*' User root may run the following commands on this host: (ALL) ALL (ALL) NOPASSWD: ALL The expected behavour for NORMAL user is instead (this comes from another machines running mandriva 2010.1): gia...@vesta ~ $ sudo -l Runas and Command-specific defaults for giampa: ignore_local_sudoers User giampa may run the following commands on this host: (ALL) NOPASSWD: ALL Is it a bug ? Is there anyone that experimented the same? Is there anything that I to set in gentoo in order to let a normal user to display correctly the sudoers commands when coming from ldap? Many thanks in advance Giampiero