Enable LDAP SUDOers on client

Leave a reply

Copied from HOW TO: Configure LDAP for SUDO Support on Ubuntu Server 9.10 (Karmic Koala)
With some addition text by me and works on Ubuntu 13.04

1.) Install LDAP Client Configuration

I. Get LibNSS-LDAP package
TIP! Have your LDAP IP, Base Name, Admin Account and Admin Password Handy before executing this command.
Code:
sudo apt-get install libnss-ldap

…nCurses based setup screen will ask you information about your LDAP setup

 

II. Enable LDAP Support in PAM system

Code:
sudo auth-client-config -t nss -p lac_ldap

III. Verify PAM based LDAP Support

Code:
sudo pam-auth-update

NOTE: Skip Step 2 for installation on the LDAP server as we already did this above!
2.) Install sudo-ldap package

I. You will need to drop fully into root mode for this part!

Code:
sudo su

II. Turn off SUDO safety switch

Code:
export SUDO_FORCE_REMOVE=yes

III. Get package

Code:
apt-get install sudo-ldap

IV. Turn on SUDO Safety switch

Code:
export SUDO_FORCE_REMOVE=no

V. Drop back to user-land mode

Code:
exit

3.) Manually setup sudo redirection from /etc/sudoers to LDAP directory

I. Add support for sudo extentions in /etc/ldap.conf
WARNING: Take note of the double “>>” in line, you do NOT want to accidentally blow out your file!

Code:
sudo echo "sudoers_base ou=SUDOers,dc=example,dc=com" >> /etc/ldap.conf

II. Symbolically link Sudo Ldap Config file to main LDAP config file
NOTE: This is not obvious in ANY documentation I have reviewed, only support forums reveled this.
This file (sudo-ldap.conf) may already exist so check and rename if so

Code:
sudo ln -s /etc/ldap.conf /etc/sudo-ldap.conf

III. Add support for sudo / ldap communication in NS Switch configuration
WARNING: Take note of the double “>>” in line, you do NOT want to accidentally blow out your file!

The below line might already be in the file (nsswitch.conf) so chcek and one run if not. On my system is was already there.

Code:
sudo echo "sudoers: ldap" >> /etc/nsswitch.conf

So good luck 🙂

Leave a Reply