I still can't find the problem after a lot of searching, can someone give me a little advice? Assembling a POC of FreeIPA 4.1.0 server (stock CentOS-7 packages) and a CentOS 6.7 server with their stock 3.0.0 packages. Sudo version on the client is sudo-1.8.6p3.
Have created a general sudo rule on the IPA server to grant access to a host group. However it doesn't allow access, just a "sparksa is not allowed to run sudo on als-centos0002". If I change the rule to not use host groups, and explicitly set the hosts, it works OK. Have checked the stuff I've seen in general search, like the nisdomainname, values are set and look plausible. The sudo debug logs seem to indicate vaguely that it can't match the netgroup: Nov 18 16:07:37 sudo username=sparksa Nov 18 16:07:37 sudo domainname=(null) Nov 18 16:07:37 sudo Received 1 rule(s) Nov 18 16:07:37 sudo sssd/ldap sudoHost '+opsauto' ... not Nov 18 16:07:37 sudo Sorting the remaining entries using the sudoOrder attribute Nov 18 16:07:37 sudo searching SSSD/LDAP for sudoers entries Nov 18 16:07:37 sudo Done with LDAP searches Nov 18 16:07:37 sudo keep HOSTNAME=als-centos0002.dakar.useast.hpcloud.net: YES Nov 18 16:07:37 sudo sudo_putenv: HOSTNAME=als-centos0002.dakar.useast.hpcloud.net The setup of the client used the normal 'ipa-client-install' script. From questions asked before, some salient debugging info: [root@als-centos0002 sys-ops]# nisdomainname dakar.useast.hpcloud.net [root@als-centos0002 sys-ops]# hostname als-centos0002.dakar.useast.hpcloud.net [root@als-centos0002 sys-ops]# getent netgroup opsauto opsauto (als-ubuntu0001.oa.ftc.hpelabs.net,-,eucalyptus.internal) (als-centos0002.dakar.useast.hpcloud.net,-,eucalyptus.internal) Does anyone have any advice on what additional debug I should look at, just not sure what I'm missing. Thanks in advance. -Alan
-- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project