Re: [Freeipa-users] ubuntu 16.04 freeipa-client + sssd + sudo: "policy plugin returns 0"

2017-05-05 Thread Brian Candler
On 03/05/2017 15:05, Brian Candler wrote: It turns out we had another 16.04 machine which was working fine. But as soon as I updated its sudo from 1.8.16-0ubuntu1.2 to 1.8.16-0ubuntu1.3, it stopped working too. So it looks like I have a reproducing case for this and I can investigate further

Re: [Freeipa-users] ubuntu 16.04 freeipa-client + sssd + sudo: "policy plugin returns 0"

2017-05-03 Thread Brian Candler
It turns out we had another 16.04 machine which was working fine. But as soon as I updated its sudo from 1.8.16-0ubuntu1.2 to 1.8.16-0ubuntu1.3, it stopped working too. So it looks like I have a reproducing case for this and I can investigate further - I suspect it's a behaviour change from th

Re: [Freeipa-users] ubuntu 16.04 freeipa-client + sssd + sudo: "policy plugin returns 0"

2017-05-03 Thread Brian Candler
> do you have 'sudo: files sss" or "sudoers: files sss"? The former doesn't do anything, the latter is correct. My mistake, I meant sudoers: files sss But oddly, out of the three 16.04 boxes I set up and enrolled, it was missing on one of them - and this happened to be the one I was checking

Re: [Freeipa-users] ubuntu 16.04 freeipa-client + sssd + sudo: "policy plugin returns 0"

2017-05-03 Thread Jakub Hrozek
On Wed, May 03, 2017 at 09:04:05AM +0100, Brian Candler wrote: > Hi, > > I have FreeIPA set up under CentOS 7. When I use freeipa-client to add an > ubuntu 14.04 client it works fine (*). However when do the same with ubuntu > 16.04, sudo always refuses to run: > > $ sudo -s > [sudo] password fo

[Freeipa-users] ubuntu 16.04 freeipa-client + sssd + sudo: "policy plugin returns 0"

2017-05-03 Thread Brian Candler
Hi, I have FreeIPA set up under CentOS 7. When I use freeipa-client to add an ubuntu 14.04 client it works fine (*). However when do the same with ubuntu 16.04, sudo always refuses to run: $ sudo -s [sudo] password for brian.candler: brian.candler is not allowed to run sudo on api-dev.int.ex