Re: [Freeipa-users] RES: RES: FreeIPA integration with AIX and sudo

Dmitri Pal Mon, 06 Apr 2015 14:58:35 -0700

On 04/06/2015 03:16 PM, Luiz Fernando Vianna da Silva wrote:

Hello Dmitri.

I finally managed to write the wiki article on configuring sudo on AIX!
Here is the URL: http://www.freeipa.org/page/SUDO_Integration_for_AIX<http://www.freeipa.org/page/SUDO_Integration_for_AIX>
I also added a reference to it on thehttp://www.freeipa.org/page/HowTos#General page as well as a topic onthe http://www.freeipa.org/page/ConfiguringUnixClients page pointingto the article.
I hope its format is up to code with FreeIPA’s formatting standardsand that the language used is clear.


Very nice!
Thanks a lot!
Looks great!

Atenciosamente/Best Regards

*__________________________________________*

*Luiz Fernando Vianna da Silva*

ITM-I - Operação Cielo

+55 (11) 3626-7126

[email protected] <mailto:[email protected]>

*T I V I T
**
*Av. Maria Coelho Aguiar, 215 - Bloco D - 5˚ Andar

São Paulo - SP - CEP 05804-900

www.tivit.com.br <http://www.tivit.com.br/>

Esta mensagem, incluindo seus anexos, tem caráter confidencial e seuconteúdo é restrito ao destinatário da mensagem. Caso você a tenharecebido por engano, queira, por favor, retorná-la ao destinatário eapagá-la de seus arquivos. Qualquer uso não autorizado, replicação oudisseminação desta mensagem ou parte dela é expressamente proibido. ATIVIT não se responsabilizará pelo conteúdo ou pela veracidade destainformação.


*De:*Luiz Fernando Vianna da Silva
*Enviada em:* quinta-feira, 2 de abril de 2015 14:41
*Para:* '[email protected]'; [email protected]
*Assunto:* RES: [Freeipa-users] RES: FreeIPA integration with AIX and sudo

Hi Dmitri.

Working on it right now. :)

Atenciosamente/Best Regards

*__________________________________________*

*Luiz Fernando Vianna da Silva*

ITM-I - Operação Cielo

+55 (11) 3626-7126

[email protected] <mailto:[email protected]>

*T I V I T
**
*Av. Maria Coelho Aguiar, 215 - Bloco D - 5˚ Andar

São Paulo - SP - CEP 05804-900

www.tivit.com.br <http://www.tivit.com.br/>

*De:*[email protected]<mailto:[email protected]>[mailto:[email protected]] *Em nome de *Dmitri Pal

*Enviada em:* quinta-feira, 2 de abril de 2015 10:23
*Para:* [email protected] <mailto:[email protected]>
*Assunto:* Re: [Freeipa-users] RES: FreeIPA integration with AIX and sudo

On 04/01/2015 01:58 PM, Luiz Fernando Vianna da Silva wrote:

    Hi Yves.

    First a little background information regarding sudo on AIX: Most
    sudo packages compiled for AIX are _/NOT/_ compiled with LDAP support.

    Although sudo’s documentation states that sudo supports different
    LDAP implementations, other than OpenLDAP, I suppose it doesn’t
    work well with AIX’s LDAP fileset.

    That’s my guess why most sudo packages for AIX aren’t compiled
    with LDAP support. [BTW, you can check this by running, as root,
    sudo -V| grep -i ldap].

    The good news is that Michel Perzl, has successfully compiled a
    sudo package with LDAP support, although its compiled against
    OpenLDAP and not AIX’s LDAP fileset.

    So, here is how I did it:

    (1) Go to http://www.perzl.org/aix/ <http://www.perzl.org/aix/>
    and download the following RPM packages on their latest versions:

    &#61623sudo >= 1.8.11

    &#61623gettext >= 0.10.40

    &#61623openldap >= 2.4.23

    &#61623openssl >= 1.0.1j-1

    &#61623zlib

    Make sure you don’t have the sudo fileset installed or another
    sudo rpm package.

    Don’t worry about openssl from this RPM package conflicting with
    the OpenSSL fileset from AIX, they won’t.

    Don’t worry about openldap from this RPM package conflicting with
    the ldap fileset from AIX, they won’t.

    (2) Upload the rpm packages to you AIX LPAR and put them all in a
    directory, I used /tmp/sudopack. [From here on I assume you are
    root on your LPAR].

    (3) From the directory where you put your packages run a “rpm -ivh
    *.rpm --test” and if all goes well proceed without the “--test”,
    otherwise sort out the dependencies and conflicts like the grown
    man you are :).

    (4) Once the rpms are installed, add the following line to the
    bottom of your /etc/netsvc.conf file: sudoers = files, ldap

    I know this is not expected syntax according to IBM’s netsvc.conf
    documentation, but sudo requires it to work with ldap. According
    to sudo’s documentation it uses that line on netsvc.conf to
    emulate what sudo would expect to find on /etc/nsswitch.conf on a
    Linux machine [hack much?].

    (5) Create a file called /etc/ldap.conf . This has nothing to do
    with the /etc/security/ldap/ldap.cfg file you use to configure
    AIX’s LDAP, this is OpenLdap’s config only used by sudo. Don’t
    worry, this won’t conflict with AIX’s LDAP functionality.

    Add this to your /etc/ldap.conf:

    tls_cacert /etc/ipa/ca.crt

    uri ldap://youripaserver.domain.com <ldap://youripaserver.domain.com>

    binddn uid=sudo,cn=sysaccounts,cn=etc,dc=domain,dc=com

    bindpw yourclientpassword

    sudoers_base ou=sudoers,dc=domain,dc=com

    (6) Create a directory called /etc/ipa and download your ca
    certificate file and place it there. Make sure to permission the
    directory 755 and the ca.crt file 644.

    (7) And that’s pretty much it, no need to edit a single line on
    /etc/sudoers. The /etc/sudoers file I have on my LPARs is the one
    that comes with the rpm, unchanged.

    Log into your LPAR with a domain user and try running “sudo -l”,
    it should output the sudo rules you set on the IPA server.

    I hope this helps you and other AIX client users out there.


Would you mind creating a howto page on the IPA wiki?

Atenciosamente/Best Regards

*__________________________________________*

*Luiz Fernando Vianna da Silva*

ITM-I - Operação Cielo

+55 (11) 3626-7126

[email protected] <mailto:[email protected]>

*T I V I T
**
*Av. Maria Coelho Aguiar, 215 - Bloco D - 5˚ Andar

São Paulo - SP - CEP 05804-900

www.tivit.com.br <http://www.tivit.com.br/>


*De:*Yves Degauquier [mailto:[email protected]]
*Enviada em:* quarta-feira, 1 de abril de 2015 14:03
*Para:* Luiz Fernando Vianna da Silva
*Assunto:* Re: [Freeipa-users] FreeIPA integration with AIX and sudo

Hi Luiz,

I was not able to make it running, I was a bit lost with the LDAP,PAM, LAM configuration, and didn't found any idea with Google...

If you can share the solution or point me to some important point todo, I will be happy.


Thanks in advance,

Best regards,

Yves

On 01/04/15 18:57, Luiz Fernando Vianna da Silva wrote:

    Hello Yves.

    I was browsing the mailing list archives and found your email from
    December 2013
    (https://www.redhat.com/archives/freeipa-users/2013-December/msg00083.html).

    I have successfully found a way to have sudo on AIX work with the
    sudo rules on IPA, just like Linux clients.

    Give me a reply if you haven’t figured out a way to make this work
    and I’ll send you the solution I came up with.

    Atenciosamente/Best Regards

    *__________________________________________*

    *Luiz Fernando Vianna da Silva*

    ITM-I - Operação Cielo

    +55 (11) 3626-7126

    [email protected] <mailto:[email protected]>

    *T I V I T
    **
    *Av. Maria Coelho Aguiar, 215 - Bloco D - 5˚ Andar

    São Paulo - SP - CEP 05804-900

    www.tivit.com.br <http://www.tivit.com.br/>

    Esta mensagem, incluindo seus anexos, tem caráter confidencial e
    seu conteúdo é restrito ao destinatário da mensagem. Caso você a
    tenha recebido por engano, queira, por favor, retorná-la ao
    destinatário e apagá-la de seus arquivos. Qualquer uso não
    autorizado, replicação ou disseminação desta mensagem ou parte
    dela é expressamente proibido. A TIVIT não se responsabilizará
    pelo conteúdo ou pela veracidade desta informação.



--
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio

Red Hat, Inc.



--
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] RES: RES: FreeIPA integration with AIX and sudo

Reply via email to