Product SiteDocumentation Site

13.4. An Example of Configuring sudo

Implementing sudo requires setting up the command configuration on the FreeIPA server and then configuring the local sudo client to look for the appropriate configuration.

13.4.1. Server Configuration for sudo Rules

  1. Optional. Set up a host group, as described in Section 6.10, “Managing Host Groups”.
  2. Optional. Create a user group and add the users, as described in Section 5.9.1, “Creating User Groups”.
  3. Set up a bind user by setting a password for the default FreeIPA sudo bind user.
    Using LDAP tools, set the password for the sudo user, uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com. For example:
    $ ldappasswd -Y GSSAPI -S -h uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
        New password: 
        Re-enter new password: 
        Enter LDAP Password:
  4. Set up the sudo commands and command groups, as described in Section 13.2, “Setting up sudo Commands and Command Groups”.
  5. Set up the sudo rules, as described in Section 13.3, “Defining sudo Rules”.

13.4.2. Client Configuration for sudo Rules

This example specifically configures a Fedora 16 client for sudo rules. The configuration file in step 4 is different, depending on the platform.
  1. Configure sudo to look to LDAP for the sudoers file.
    vim /etc/nsswitch.conf
    sudoers:  files ldap
    Leaving the files option in place allows sudo to check its local configuration before checking the LDAP-based FreeIPA configuration.
  2. Enable debug logging for sudo operations in the /etc/ldap.conf file. If this file does not exist, it can be created.
    vim /etc/ldap.conf
    sudoers_debug: 1


    Adding the sudoers_debug parameter helps with troubleshooting. Valid values for this parameter are 0, 1, and 2. The sudo documentation at has more information on debugging the process.
  3. Optionally, enable debugging in SSSD to show what LDAP settings it is using.
    vim /etc/sssd/sssd.conf
    debug_level = 6
    The LDAP search base used by SSSD for operations is recorded in the sssd_DOMAINNAME.log log.
  4. Edit the NSS/LDAP configuration file and add the following sudo-related lines to the /etc/nslcd.conf file:
    binddn uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
    bindpw sudo_password
    ssl start_tls
    tls_cacertfile /etc/ipa/ca.crt
    tls_checkpeer yes
    bind_timelimit 5
    timelimit 15
    uri ldap:// ldap://
    sudoers_base ou=SUDOers,dc=example,dc=com
    Multiple LDAP servers can be configured in a space-separated list, and other options (like SSL and non-standard ports) can be used with the LDAP URL. The sudo LDAP configuration is covered in the sudo manpages,


    The uri directive must give the fully-qualified domain name of the LDAP server, not an IP address. Otherwise, sudo fails to connect to the LDAP server.
  5. Set a name for the NIS domain in the sudo configuration. sudo uses NIS netgroups, so the NIS domain name must be set in the system configuration for sudo to be able to find the host groups used in the FreeIPA sudo configuration.
    1. Open the /etc/rc.d/rc.local file. Setting the NIS domain name in this file allows the value to persist between reboots.
      # vim /etc/rc.d/rc.local
    2. Add the command to set the NIS domain name.


    Even though sudo uses NIS-style netgroups, it is not necessary to have a NIS server installed. Netgroups require that a NIS domain be named in their configuration, so sudo requires that a NIS domain be named for netgroups. However, that NIS domain does not actually need to exist.