Hey Michael.

I have never added Ubuntu or Debian machines to an IPA server. I have gotten RHEL 5/6/7, HPUX 11.31 and Solaris 10/11 machines added and working on my IPA servers. So I can hope to shed some light from my troubles. I have found that the issue lies with how the sudo on the server resolves it's own hostname.

Can you attempted to debug sudo? You should be able to add a debug line sssd.conf in the [sudo] section.

Also have you tried to add a rule and explicitly list the server (not group)? This will help determine if the issue is related to the host and passing comparing with the FQDN or if it's having issues expanding host groups.

I'm sure you already know this, but including just in case:

From the sssd.conf man page from Ubuntu you can have a setting in there - hostid_provider - make sure that is set to ipa. I'm sure this is setup from the installation.

The man page also states: "Note: in order to use netgroups or IPA hostgroups in sudo rules, you also need to correctly set nisdomainname(1) to your NIS domain name (which equals to IPA domain name when using hostgroups)."

You can also set a setting in the sssd.conf to reflect the FQDN correctly ipa_hostname = FQDN. I have had to set this, due to not being able to change hostnames from shortname to FQDN.

Common things I have ran into / fixed - - hosts file is not setup correctly for the host. The host entry for itself has to be setup as 10.0.0.5 ServerFQDN ServerShortname

- Set the server name to the FQDN vs shortname. If unable to set, statically set the hostname with the --hostname option on installation.

- Ensure that the host entry FQDN in IPA is the same as the hosts file/hostname. Otherwise you can set the hostname statically in sssd.conf with

- Set the nisdomain name to IPA domain.

- Added a sudo option into the sudo rule "fqdn", to ensure the fqdn will be used by the hosts.

I would be more interested in what the debugging produces.

-Aaron

Hi thanks for your tips support, I follow your tips and also find a RedHat document -> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/htm...

In short words: - follow the instructions - enable logging (sudoers_debug 2) -> got the following result: sudo rule for host group does not match because ldap search for hosts instead of host groups :-(

ipa-lx-test-debian9% sudo -l sudo: LDAP Config Summary sudo: =================== sudo: uri ldaps://ipa-lx-test-01.example.world.com sudo: uri ldap://ipa-prod-01.example.world.com sudo: ldap_version 3 sudo: sudoers_base ou=SUDOers,dc=example,dc=world,dc=com sudo: search_filter (objectClass=sudoRole) sudo: netgroup_base (NONE: will use nsswitch) sudo: netgroup_search_filter (objectClass=nisNetgroup) sudo: binddn uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=world,dc=com sudo: bindpw MySecurePassword sudo: bind_timelimit 5 sudo: timelimit 15 sudo: ssl (no) sudo: tls_checkpeer (yes) sudo: tls_cacertfile /etc/ipa/ca.crt sudo: =================== sudo: ldap_set_option: debug -> 0 sudo: ldap_set_option: tls_checkpeer -> 1 sudo: ldap_set_option: tls_cacertfile -> /etc/ipa/ca.crt sudo: ldap_set_option: tls_cacert -> /etc/ipa/ca.crt sudo: ldap_initialize(ld, ldaps://ipa-lx-test-01.example.world.com ldap://ipa-prod-01.example.world.com) sudo: ldap_set_option: ldap_version -> 3 sudo: ldap_set_option: timelimit -> 15 sudo: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT, 5) sudo: ldap_sasl_bind_s() ok sudo: Looking for cn=defaults: (&(objectClass=sudoRole)(cn=defaults)) sudo: no default options found in ou=SUDOers,dc=example,dc=world,dc=com sudo: ldap search '(&(objectClass=sudoRole)(|(sudoUser=webtrekk)(sudoUser=%webtrekk)(sudoUser=%#299801104)(sudoUser=%domänen-benutzer)(sudoUser=%mitarbeiter)(sudoUser=%wt-it-warp)(sudoUser=%wt-it)(sudoUser=%ad_users)(sudoUser=%wt-it-warp)(sudoUser=%#299800513)(sudoUser=%#299801109)(sudoUser=%#299801114)(sudoUser=%#299801116)(sudoUser=%#556800008)(sudoUser=%#556800012)(sudoUser=ALL)))' sudo: searching from base 'ou=SUDOers,dc=example,dc=world,dc=com' sudo: adding search result sudo: ldap sudoHost '+centos_group' ... not sudo: ldap sudoHost '+debian_group' ... not sudo: ldap sudoHost '+ubuntu_group' ... not sudo: result now has 0 entries sudo: ldap search '(&(objectClass=sudoRole)(sudoUser=)(sudoUser=+))' sudo: searching from base 'ou=SUDOers,dc=example,dc=world,dc=com' sudo: adding search result sudo: result now has 0 entries sudo: perform search for pwflag 54 sudo: done with LDAP searches sudo: user_matches=true sudo: host_matches=false sudo: sudo_ldap_lookup(54)=0x84 [sudo] Password for user:

Hi Aaron, I found this information very helpful for debugging a CentOS 7 box that is having the same problem, thank you.

On my box, sudo over SSSD is working, but not with host groups, only with specific hosts listed. So there's some problem with the host expansion as you point out, but I'm unable to find the right log entries. I used the document at https://docs.pagure.org/SSSD.sssd/users/sudo_troubleshooting.html to set up the logging.

Do you know any keywords that I can grep for that would narrow down the log lines that are relevant? These log files are really big!

Thanks, Brian

Thanks Aaron, appreciate the input. Happy Friday!

I read that article and that key-value does not exist. I also set the FQDN before `ipa-client-install` and let it do it's magic. Only sssd.conf changes to add debug configuration (https://gist.github.com/briantopping/671341ea8025f127588a66801932c19f). Output of both `domainname` and `nisdomainname` match `ipa_domain` in sssd.conf. Seemingly relevant package versions are below.

The debug logs seem exhaustive, are there clues in there?

Thanks! Brian

Client: CentOS Linux release 7.4.1708 (Core) ipa-client-4.5.0-21.el7.centos.2.2.x86_64 sssd-ipa-1.15.2-50.el7_4.6.x86_64

Server: CentOS Linux release 7.4.1708 (Core) ipa-server-4.5.0-21.el7.centos.2.2.x86_64 sssd-ipa-1.15.2-50.el7_4.6.x86_64