sudo doesn't work on IPA clients/hosts if default host-group "ipaservers" is specified in sudo rule.

Solution Verified - Updated -

Issue

  • sudo doesn't work on IPA clients if default host-group ipaservers is specified in sudo rule.
  • sudo fails on IPA clients if sudo-rule is applied on default host-group ipaservers:
[root@ipaserver ~]# ipa sudorule-show testsudo
  Rule name: testsudo
  Enabled: TRUE
  Command category: all
  User Groups: testgroup
  Host Groups: ipaservers   <-----

[root@ipaclient ~]# id testuser
uid=100001(testuser) gid=100001(testuser) goups=100001(testuser),100011(testgroup)

[root@ipaclient ~]# sudo -ll -U testuser
User testuser is not allowed to run sudo on ipaclient.  <-----

Environment

  • Red Hat Enterprise Linux 7.x
  • IPA 4.x
  • sudo

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.