Product SiteDocumentation Site

Chapter 13. Policy: Using sudo

13.1. About sudo and IPA
13.1.1. General sudo Configuration in FreeIPA
13.1.2. sudo and Netgroups
13.1.3. Supported sudo Clients
13.2. Setting up sudo Commands and Command Groups
13.2.1. Adding sudo Commands
13.2.2. Adding sudo Command Groups
13.3. Defining sudo Rules
13.3.1. About External Users and Hosts
13.3.2. About sudo Options Format
13.3.3. Defining sudo Rules in the Web UI
13.3.4. Defining sudo Rules in the Command Line
13.4. An Example of Configuring sudo
13.4.1. Server Configuration for sudo Rules
13.4.2. Client Configuration for sudo Rules
FreeIPA provides a mechanism for predictably and consistently apply sudo policies across the FreeIPA domain. The sudo policies apply to domain users and domain hosts.

13.1. About sudo and IPA

The sudo command allows a system administrator to delegate authority to specific users to run specific commands as root or another specified user. sudo provides an audit trail of the commands and their arguments, so access can be tracked.

13.1.1. General sudo Configuration in FreeIPA

sudo uses a local configuration file, /etc/sudoers, which defines the commands and users with sudo access. While this file can be shared among machines, there's no native way to distribute sudo configuration files among machines.
FreeIPA uses its centralized LDAP database to contain the sudo configuration, which makes it globally available to all domain hosts. FreeIPA also has a specialized LDAP schema for sudo entries that allows a lot more flexible and simpler configuration. This schema adds two key features:
  • The FreeIPA schema supports host groups in addition to netgroups for sudo, while sudo only supports netgroups.
    For every host group, FreeIPA also creates a corresponding shadow netgroup. This allows FreeIPA administrators to create sudo rules that reference host groups, while the local sudo command uses the corresponding netgroup.
  • FreeIPA introduces the concept of a sudo command group. The group contains multiple commands, and then the command group can be referenced in the sudo configuration.
Because sudo does not support host groups and command groups, FreeIPA translates the FreeIPA sudo configuration into native sudo configuration when the sudo rules are created.
Both sudo and FreeIPA support user groups as part of the sudo configuration. User groups can be either Unix or non-POSIX groups. Creating non-POSIX groups can create some access issues because any users in the group inherit non-POSIX rights from the group. Having the choice between Unix and non-POSIX groups allows administrators the choice in group formatting and to avoid problems with inherited permissions or GID information.

13.1.2. sudo and Netgroups

As Section 13.1.1, “General sudo Configuration in FreeIPA” mentions, the LDAP schema used for sudo entries in FreeIPA supports host group-style groups in addition to netgroups. Really, FreeIPA creates two groups, a visible host group and a shadow netgroup. sudo itself only supports NIS-style netgroups for group formats.
One important thing to consider is that even though sudo uses NIS netgroups, it is not necessary to have a NIS server installed or a NIS client configured. When any group is created for sudo, the NIS object is created in the Directory Server instance, and then the information is retrieved by NSS_LDAP or by SSSD. The client (in this case, sudo) then extracts the required NIS information from the information provided by FreeIPA's Directory Server.
In short, sudo configuration required NIS-formatted netgroups. It does not require NIS.
The FreeIPA Directory Server instance uses the standard LDAP schema for NIS objects, defined in RFC 2307.

13.1.3. Supported sudo Clients

Any system which is supported as an FreeIPA client system can be configured as a sudo client in FreeIPA.