1 .\" Copyright (c) 2003-2011
2 .\" Todd C. Miller <Todd.Miller@courtesan.com>
4 .\" Permission to use, copy, modify, and distribute this software for any
5 .\" purpose with or without fee is hereby granted, provided that the above
6 .\" copyright notice and this permission notice appear in all copies.
8 .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
17 .\" Automatically generated by Pod::Man 2.23 (Pod::Simple 3.14)
19 .\" Standard preamble:
20 .\" ========================================================================
21 .de Sp \" Vertical space (when we can't use .PP)
25 .de Vb \" Begin verbatim text
30 .de Ve \" End verbatim text
34 .\" Set up some character translations and predefined strings. \*(-- will
35 .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
36 .\" double quote, and \*(R" will give a right double quote. \*(C+ will
37 .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
38 .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
39 .\" nothing in troff, for use with C<>.
41 .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
45 . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
46 . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
59 .\" Escape single quotes in literal strings from groff's Unicode transform.
63 .\" If the F register is turned on, we'll generate index entries on stderr for
64 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
65 .\" entries marked with X<> in POD. Of course, you'll have to process the
66 .\" output yourself in some meaningful fashion.
69 . tm Index:\\$1\t\\n%\t"\\$2"
79 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
80 .\" Fear. Run. Save yourself. No user-serviceable parts.
81 . \" fudge factors for nroff and troff
90 . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
96 . \" simple accents for nroff and troff
106 . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
107 . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
108 . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
109 . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
110 . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
111 . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
113 . \" troff and (daisy-wheel) nroff accents
114 .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
115 .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
116 .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
117 .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
118 .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
119 .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
120 .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
121 .ds ae a\h'-(\w'a'u*4/10)'e
122 .ds Ae A\h'-(\w'A'u*4/10)'E
123 . \" corrections for vroff
124 .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
125 .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
126 . \" for low resolution devices (crt and lpr)
127 .if \n(.H>23 .if \n(.V>19 \
140 .\" ========================================================================
142 .IX Title "SUDOERS.LDAP @mansectform@"
143 .TH SUDOERS.LDAP @mansectform@ "April 9, 2011" "1.7.6" "MAINTENANCE COMMANDS"
144 .\" For nroff, turn off justification. Always turn off hyphenation; it makes
145 .\" way too many mistakes in technical documents.
149 sudoers.ldap \- sudo LDAP configuration
151 .IX Header "DESCRIPTION"
152 In addition to the standard \fIsudoers\fR file, \fBsudo\fR may be configured
153 via \s-1LDAP\s0. This can be especially useful for synchronizing \fIsudoers\fR
154 in a large, distributed environment.
156 Using \s-1LDAP\s0 for \fIsudoers\fR has several benefits:
158 \&\fBsudo\fR no longer needs to read \fIsudoers\fR in its entirety. When
159 \&\s-1LDAP\s0 is used, there are only two or three \s-1LDAP\s0 queries per invocation.
160 This makes it especially fast and particularly usable in \s-1LDAP\s0
163 \&\fBsudo\fR no longer exits if there is a typo in \fIsudoers\fR.
164 It is not possible to load \s-1LDAP\s0 data into the server that does
165 not conform to the sudoers schema, so proper syntax is guaranteed.
166 It is still possible to have typos in a user or host name, but
167 this will not prevent \fBsudo\fR from running.
169 It is possible to specify per-entry options that override the global
170 default options. \fI@sysconfdir@/sudoers\fR only supports default options and
171 limited options associated with user/host/commands/aliases. The
172 syntax is complicated and can be difficult for users to understand.
173 Placing the options directly in the entry is more natural.
175 The \fBvisudo\fR program is no longer needed. \fBvisudo\fR provides
176 locking and syntax checking of the \fI@sysconfdir@/sudoers\fR file.
177 Since \s-1LDAP\s0 updates are atomic, locking is no longer necessary.
178 Because syntax is checked when the data is inserted into \s-1LDAP\s0, there
179 is no need for a specialized tool to check syntax.
181 Another major difference between \s-1LDAP\s0 and file-based \fIsudoers\fR
182 is that in \s-1LDAP\s0, \fBsudo\fR\-specific Aliases are not supported.
184 For the most part, there is really no need for \fBsudo\fR\-specific
185 Aliases. Unix groups or user netgroups can be used in place of
186 User_Aliases and Runas_Aliases. Host netgroups can be used in place
187 of Host_Aliases. Since Unix groups and netgroups can also be stored
188 in \s-1LDAP\s0 there is no real need for \fBsudo\fR\-specific aliases.
190 Cmnd_Aliases are not really required either since it is possible
191 to have multiple users listed in a \f(CW\*(C`sudoRole\*(C'\fR. Instead of defining
192 a Cmnd_Alias that is referenced by multiple users, one can create
193 a \f(CW\*(C`sudoRole\*(C'\fR that contains the commands and assign multiple users
195 .SS "SUDOers \s-1LDAP\s0 container"
196 .IX Subsection "SUDOers LDAP container"
197 The \fIsudoers\fR configuration is contained in the \f(CW\*(C`ou=SUDOers\*(C'\fR \s-1LDAP\s0
200 Sudo first looks for the \f(CW\*(C`cn=default\*(C'\fR entry in the SUDOers container.
201 If found, the multi-valued \f(CW\*(C`sudoOption\*(C'\fR attribute is parsed in the
202 same manner as a global \f(CW\*(C`Defaults\*(C'\fR line in \fI@sysconfdir@/sudoers\fR. In
203 the following example, the \f(CW\*(C`SSH_AUTH_SOCK\*(C'\fR variable will be preserved
204 in the environment for all users.
207 \& dn: cn=defaults,ou=SUDOers,dc=example,dc=com
209 \& objectClass: sudoRole
211 \& description: Default sudoOption\*(Aqs go here
212 \& sudoOption: env_keep+=SSH_AUTH_SOCK
215 The equivalent of a sudoer in \s-1LDAP\s0 is a \f(CW\*(C`sudoRole\*(C'\fR. It consists of
216 the following attributes:
217 .IP "\fBsudoUser\fR" 4
219 A user name, uid (prefixed with \f(CW\*(Aq#\*(Aq\fR), Unix group (prefixed with
220 a \f(CW\*(Aq%\*(Aq\fR) or user netgroup (prefixed with a \f(CW\*(Aq+\*(Aq\fR).
221 .IP "\fBsudoHost\fR" 4
223 A host name, \s-1IP\s0 address, \s-1IP\s0 network, or host netgroup (prefixed
224 with a \f(CW\*(Aq+\*(Aq\fR).
225 The special value \f(CW\*(C`ALL\*(C'\fR will match any host.
226 .IP "\fBsudoCommand\fR" 4
227 .IX Item "sudoCommand"
228 A Unix command with optional command line arguments, potentially
229 including globbing characters (aka wild cards).
230 The special value \f(CW\*(C`ALL\*(C'\fR will match any command.
231 If a command is prefixed with an exclamation point \f(CW\*(Aq!\*(Aq\fR, the
232 user will be prohibited from running that command.
233 .IP "\fBsudoOption\fR" 4
234 .IX Item "sudoOption"
235 Identical in function to the global options described above, but
236 specific to the \f(CW\*(C`sudoRole\*(C'\fR in which it resides.
237 .IP "\fBsudoRunAsUser\fR" 4
238 .IX Item "sudoRunAsUser"
239 A user name or uid (prefixed with \f(CW\*(Aq#\*(Aq\fR) that commands may be run
240 as or a Unix group (prefixed with a \f(CW\*(Aq%\*(Aq\fR) or user netgroup (prefixed
241 with a \f(CW\*(Aq+\*(Aq\fR) that contains a list of users that commands may be
243 The special value \f(CW\*(C`ALL\*(C'\fR will match any user.
245 The \f(CW\*(C`sudoRunAsUser\*(C'\fR attribute is only available in \fBsudo\fR versions
246 1.7.0 and higher. Older versions of \fBsudo\fR use the \f(CW\*(C`sudoRunAs\*(C'\fR
248 .IP "\fBsudoRunAsGroup\fR" 4
249 .IX Item "sudoRunAsGroup"
250 A Unix group or gid (prefixed with \f(CW\*(Aq#\*(Aq\fR) that commands may be run as.
251 The special value \f(CW\*(C`ALL\*(C'\fR will match any group.
253 The \f(CW\*(C`sudoRunAsGroup\*(C'\fR attribute is only available in \fBsudo\fR versions
255 .IP "\fBsudoNotBefore\fR" 4
256 .IX Item "sudoNotBefore"
257 A timestamp in the form \f(CW\*(C`yyyymmddHHMMZ\*(C'\fR that can be used to provide
258 a start date/time for when the \f(CW\*(C`sudoRole\*(C'\fR will be valid. If
259 multiple \f(CW\*(C`sudoNotBefore\*(C'\fR entries are present, the earliest is used.
260 Note that timestamps must be in Coordinated Universal Time (\s-1UTC\s0),
261 not the local timezone.
263 The \f(CW\*(C`sudoNotBefore\*(C'\fR attribute is only available in \fBsudo\fR versions
264 1.7.5 and higher and must be explicitly enabled via the \fB\s-1SUDOERS_TIMED\s0\fR
265 option in \fI@ldap_conf@\fR.
266 .IP "\fBsudoNotAfter\fR" 4
267 .IX Item "sudoNotAfter"
268 A timestamp in the form \f(CW\*(C`yyyymmddHHMMZ\*(C'\fR that indicates an expiration
269 date/time, after which the \f(CW\*(C`sudoRole\*(C'\fR will no longer be valid. If
270 multiple \f(CW\*(C`sudoNotBefore\*(C'\fR entries are present, the last one is used.
271 Note that timestamps must be in Coordinated Universal Time (\s-1UTC\s0),
272 not the local timezone.
274 The \f(CW\*(C`sudoNotAfter\*(C'\fR attribute is only available in \fBsudo\fR versions
275 1.7.5 and higher and must be explicitly enabled via the \fB\s-1SUDOERS_TIMED\s0\fR
276 option in \fI@ldap_conf@\fR.
277 .IP "\fBsudoOrder\fR" 4
279 The \f(CW\*(C`sudoRole\*(C'\fR entries retrieved from the \s-1LDAP\s0 directory have no
280 inherent order. The \f(CW\*(C`sudoOrder\*(C'\fR attribute is an integer (or
281 floating point value for \s-1LDAP\s0 servers that support it) that is used
282 to sort the matching entries. This allows LDAP-based sudoers entries
283 to more closely mimic the behaviour of the sudoers file, where the
284 of the entries influences the result. If multiple entries match,
285 the entry with the highest \f(CW\*(C`sudoOrder\*(C'\fR attribute is chosen. This
286 corresponds to the \*(L"last match\*(R" behavior of the sudoers file. If
287 the \f(CW\*(C`sudoOrder\*(C'\fR attribute is not present, a value of 0 is assumed.
289 The \f(CW\*(C`sudoOrder\*(C'\fR attribute is only available in \fBsudo\fR versions
292 Each attribute listed above should contain a single value, but there
293 may be multiple instances of each attribute type. A \f(CW\*(C`sudoRole\*(C'\fR must
294 contain at least one \f(CW\*(C`sudoUser\*(C'\fR, \f(CW\*(C`sudoHost\*(C'\fR and \f(CW\*(C`sudoCommand\*(C'\fR.
296 The following example allows users in group wheel to run any command
297 on any host via \fBsudo\fR:
300 \& dn: cn=%wheel,ou=SUDOers,dc=example,dc=com
302 \& objectClass: sudoRole
308 .SS "Anatomy of \s-1LDAP\s0 sudoers lookup"
309 .IX Subsection "Anatomy of LDAP sudoers lookup"
310 When looking up a sudoer using \s-1LDAP\s0 there are only two or three
311 \&\s-1LDAP\s0 queries per invocation. The first query is to parse the global
312 options. The second is to match against the user's name and the
313 groups that the user belongs to. (The special \s-1ALL\s0 tag is matched
314 in this query too.) If no match is returned for the user's name
315 and groups, a third query returns all entries containing user
316 netgroups and checks to see if the user belongs to any of them.
318 If timed entries are enabled with the \fB\s-1SUDOERS_TIMED\s0\fR configuration
319 directive, the \s-1LDAP\s0 queries include a subfilter that limits retrieval
320 to entries that satisfy the time constraints, if any.
321 .SS "Differences between \s-1LDAP\s0 and non-LDAP sudoers"
322 .IX Subsection "Differences between LDAP and non-LDAP sudoers"
323 There are some subtle differences in the way sudoers is handled
324 once in \s-1LDAP\s0. Probably the biggest is that according to the \s-1RFC\s0,
325 \&\s-1LDAP\s0 ordering is arbitrary and you cannot expect that Attributes
326 and Entries are returned in any specific order.
328 The order in which different entries are applied can be controlled
329 using the \f(CW\*(C`sudoOrder\*(C'\fR attribute, but there is no way to guarantee
330 the order of attributes within a specific entry. If there are
331 conflicting command rules in an entry, the negative takes precedence.
332 This is called paranoid behavior (not necessarily the most specific
339 \& # Allow all commands except shell
340 \& johnny ALL=(root) ALL,!/bin/sh
341 \& # Always allows all commands because ALL is matched last
342 \& puddles ALL=(root) !/bin/sh,ALL
344 \& # LDAP equivalent of johnny
345 \& # Allows all commands except shell
346 \& dn: cn=role1,ou=Sudoers,dc=my\-domain,dc=com
347 \& objectClass: sudoRole
353 \& sudoCommand: !/bin/sh
355 \& # LDAP equivalent of puddles
356 \& # Notice that even though ALL comes last, it still behaves like
357 \& # role1 since the LDAP code assumes the more paranoid configuration
358 \& dn: cn=role2,ou=Sudoers,dc=my\-domain,dc=com
359 \& objectClass: sudoRole
364 \& sudoCommand: !/bin/sh
368 Another difference is that negations on the Host, User or Runas are
369 currently ignored. For example, the following attributes do not
370 behave the way one might expect.
373 \& # does not match all but joe
374 \& # rather, does not match anyone
377 \& # does not match all but joe
378 \& # rather, matches everyone including Joe
382 \& # does not match all but web01
383 \& # rather, matches all hosts including web01
388 .IX Subsection "Sudoers Schema"
389 In order to use \fBsudo\fR's \s-1LDAP\s0 support, the \fBsudo\fR schema must be
390 installed on your \s-1LDAP\s0 server. In addition, be sure to index the
391 \&'sudoUser' attribute.
393 Three versions of the schema: one for OpenLDAP servers (\fIschema.OpenLDAP\fR),
394 one for Netscape-derived servers (\fIschema.iPlanet\fR), and one for
395 Microsoft Active Directory (\fIschema.ActiveDirectory\fR) may
396 be found in the \fBsudo\fR distribution.
398 The schema for \fBsudo\fR in OpenLDAP form is included in the \s-1EXAMPLES\s0
400 .SS "Configuring ldap.conf"
401 .IX Subsection "Configuring ldap.conf"
402 Sudo reads the \fI@ldap_conf@\fR file for LDAP-specific configuration.
403 Typically, this file is shared amongst different LDAP-aware clients.
404 As such, most of the settings are not \fBsudo\fR\-specific. Note that
405 \&\fBsudo\fR parses \fI@ldap_conf@\fR itself and may support options
406 that differ from those described in the \fIldap.conf\fR\|(@mansectform@) manual.
408 Also note that on systems using the OpenLDAP libraries, default
409 values specified in \fI/etc/openldap/ldap.conf\fR or the user's
410 \&\fI.ldaprc\fR files are not used.
412 Only those options explicitly listed in \fI@ldap_conf@\fR as being
413 supported by \fBsudo\fR are honored. Configuration options are listed
414 below in upper case but are parsed in a case-independent manner.
415 .IP "\fB\s-1URI\s0\fR ldap[s]://[hostname[:port]] ..." 4
416 .IX Item "URI ldap[s]://[hostname[:port]] ..."
417 Specifies a whitespace-delimited list of one or more URIs describing
418 the \s-1LDAP\s0 server(s) to connect to. The \fIprotocol\fR may be either
419 \&\fBldap\fR or \fBldaps\fR, the latter being for servers that support \s-1TLS\s0
420 (\s-1SSL\s0) encryption. If no \fIport\fR is specified, the default is port
421 389 for \f(CW\*(C`ldap://\*(C'\fR or port 636 for \f(CW\*(C`ldaps://\*(C'\fR. If no \fIhostname\fR
422 is specified, \fBsudo\fR will connect to \fBlocalhost\fR. Multiple \fB\s-1URI\s0\fR
423 lines are treated identically to a \fB\s-1URI\s0\fR line containing multiple
424 entries. Only systems using the OpenSSL libraries support the
425 mixing of \f(CW\*(C`ldap://\*(C'\fR and \f(CW\*(C`ldaps://\*(C'\fR URIs. The Netscape-derived
426 libraries used on most commercial versions of Unix are only capable
427 of supporting one or the other.
428 .IP "\fB\s-1HOST\s0\fR name[:port] ..." 4
429 .IX Item "HOST name[:port] ..."
430 If no \fB\s-1URI\s0\fR is specified, the \fB\s-1HOST\s0\fR parameter specifies a
431 whitespace-delimited list of \s-1LDAP\s0 servers to connect to. Each host
432 may include an optional \fIport\fR separated by a colon (':'). The
433 \&\fB\s-1HOST\s0\fR parameter is deprecated in favor of the \fB\s-1URI\s0\fR specification
434 and is included for backwards compatibility.
435 .IP "\fB\s-1PORT\s0\fR port_number" 4
436 .IX Item "PORT port_number"
437 If no \fB\s-1URI\s0\fR is specified, the \fB\s-1PORT\s0\fR parameter specifies the
438 default port to connect to on the \s-1LDAP\s0 server if a \fB\s-1HOST\s0\fR parameter
439 does not specify the port itself. If no \fB\s-1PORT\s0\fR parameter is used,
440 the default is port 389 for \s-1LDAP\s0 and port 636 for \s-1LDAP\s0 over \s-1TLS\s0
441 (\s-1SSL\s0). The \fB\s-1PORT\s0\fR parameter is deprecated in favor of the \fB\s-1URI\s0\fR
442 specification and is included for backwards compatibility.
443 .IP "\fB\s-1BIND_TIMELIMIT\s0\fR seconds" 4
444 .IX Item "BIND_TIMELIMIT seconds"
445 The \fB\s-1BIND_TIMELIMIT\s0\fR parameter specifies the amount of time, in seconds,
446 to wait while trying to connect to an \s-1LDAP\s0 server. If multiple \fB\s-1URI\s0\fRs or
447 \&\fB\s-1HOST\s0\fRs are specified, this is the amount of time to wait before trying
448 the next one in the list.
449 .IP "\fB\s-1NETWORK_TIMEOUT\s0\fR seconds" 4
450 .IX Item "NETWORK_TIMEOUT seconds"
451 An alias for \fB\s-1BIND_TIMELIMIT\s0\fR for OpenLDAP compatibility.
452 .IP "\fB\s-1TIMELIMIT\s0\fR seconds" 4
453 .IX Item "TIMELIMIT seconds"
454 The \fB\s-1TIMELIMIT\s0\fR parameter specifies the amount of time, in seconds,
455 to wait for a response to an \s-1LDAP\s0 query.
456 .IP "\fB\s-1TIMEOUT\s0\fR seconds" 4
457 .IX Item "TIMEOUT seconds"
458 The \fB\s-1TIMEOUT\s0\fR parameter specifies the amount of time, in seconds,
459 to wait for a response from the various \s-1LDAP\s0 APIs.
460 .IP "\fB\s-1SUDOERS_BASE\s0\fR base" 4
461 .IX Item "SUDOERS_BASE base"
462 The base \s-1DN\s0 to use when performing \fBsudo\fR \s-1LDAP\s0 queries. Typically
463 this is of the form \f(CW\*(C`ou=SUDOers,dc=example,dc=com\*(C'\fR for the domain
464 \&\f(CW\*(C`example.com\*(C'\fR. Multiple \fB\s-1SUDOERS_BASE\s0\fR lines may be specified,
465 in which case they are queried in the order specified.
466 .IP "\fB\s-1SUDOERS_SEARCH_FILTER\s0\fR ldap_filter" 4
467 .IX Item "SUDOERS_SEARCH_FILTER ldap_filter"
468 An \s-1LDAP\s0 filter which is used to restrict the set of records returned
469 when performing a \fBsudo\fR \s-1LDAP\s0 query. Typically, this is of the
470 form \f(CW\*(C`attribute=value\*(C'\fR or \f(CW\*(C`(&(attribute=value)(attribute2=value2))\*(C'\fR.
471 .IP "\fB\s-1SUDOERS_TIMED\s0\fR on/true/yes/off/false/no" 4
472 .IX Item "SUDOERS_TIMED on/true/yes/off/false/no"
473 Whether or not to evaluate the \f(CW\*(C`sudoNotBefore\*(C'\fR and \f(CW\*(C`sudoNotAfter\*(C'\fR
474 attributes that implement time-dependent sudoers entries.
475 .IP "\fB\s-1SUDOERS_DEBUG\s0\fR debug_level" 4
476 .IX Item "SUDOERS_DEBUG debug_level"
477 This sets the debug level for \fBsudo\fR \s-1LDAP\s0 queries. Debugging
478 information is printed to the standard error. A value of 1 results
479 in a moderate amount of debugging information. A value of 2 shows
480 the results of the matches themselves. This parameter should not
481 be set in a production environment as the extra information is
482 likely to confuse users.
483 .IP "\fB\s-1BINDDN\s0\fR \s-1DN\s0" 4
485 The \fB\s-1BINDDN\s0\fR parameter specifies the identity, in the form of a
486 Distinguished Name (\s-1DN\s0), to use when performing \s-1LDAP\s0 operations.
487 If not specified, \s-1LDAP\s0 operations are performed with an anonymous
488 identity. By default, most \s-1LDAP\s0 servers will allow anonymous access.
489 .IP "\fB\s-1BINDPW\s0\fR secret" 4
490 .IX Item "BINDPW secret"
491 The \fB\s-1BINDPW\s0\fR parameter specifies the password to use when performing
492 \&\s-1LDAP\s0 operations. This is typically used in conjunction with the
493 \&\fB\s-1BINDDN\s0\fR parameter.
494 .IP "\fB\s-1ROOTBINDDN\s0\fR \s-1DN\s0" 4
495 .IX Item "ROOTBINDDN DN"
496 The \fB\s-1ROOTBINDDN\s0\fR parameter specifies the identity, in the form of
497 a Distinguished Name (\s-1DN\s0), to use when performing privileged \s-1LDAP\s0
498 operations, such as \fIsudoers\fR queries. The password corresponding
499 to the identity should be stored in \fI@ldap_secret@\fR.
500 If not specified, the \fB\s-1BINDDN\s0\fR identity is used (if any).
501 .IP "\fB\s-1LDAP_VERSION\s0\fR number" 4
502 .IX Item "LDAP_VERSION number"
503 The version of the \s-1LDAP\s0 protocol to use when connecting to the server.
504 The default value is protocol version 3.
505 .IP "\fB\s-1SSL\s0\fR on/true/yes/off/false/no" 4
506 .IX Item "SSL on/true/yes/off/false/no"
507 If the \fB\s-1SSL\s0\fR parameter is set to \f(CW\*(C`on\*(C'\fR, \f(CW\*(C`true\*(C'\fR or \f(CW\*(C`yes\*(C'\fR, \s-1TLS\s0
508 (\s-1SSL\s0) encryption is always used when communicating with the \s-1LDAP\s0
509 server. Typically, this involves connecting to the server on port
511 .IP "\fB\s-1SSL\s0\fR start_tls" 4
512 .IX Item "SSL start_tls"
513 If the \fB\s-1SSL\s0\fR parameter is set to \f(CW\*(C`start_tls\*(C'\fR, the \s-1LDAP\s0 server
514 connection is initiated normally and \s-1TLS\s0 encryption is begun before
515 the bind credentials are sent. This has the advantage of not
516 requiring a dedicated port for encrypted communications. This
517 parameter is only supported by \s-1LDAP\s0 servers that honor the \f(CW\*(C`start_tls\*(C'\fR
518 extension, such as the OpenLDAP server.
519 .IP "\fB\s-1TLS_CHECKPEER\s0\fR on/true/yes/off/false/no" 4
520 .IX Item "TLS_CHECKPEER on/true/yes/off/false/no"
521 If enabled, \fB\s-1TLS_CHECKPEER\s0\fR will cause the \s-1LDAP\s0 server's \s-1TLS\s0
522 certificated to be verified. If the server's \s-1TLS\s0 certificate cannot
523 be verified (usually because it is signed by an unknown certificate
524 authority), \fBsudo\fR will be unable to connect to it. If \fB\s-1TLS_CHECKPEER\s0\fR
525 is disabled, no check is made. Note that disabling the check creates
526 an opportunity for man-in-the-middle attacks since the server's
527 identity will not be authenticated. If possible, the \s-1CA\s0's certificate
528 should be installed locally so it can be verified.
529 .IP "\fB\s-1TLS_CACERT\s0\fR file name" 4
530 .IX Item "TLS_CACERT file name"
531 An alias for \fB\s-1TLS_CACERTFILE\s0\fR for OpenLDAP compatibility.
532 .IP "\fB\s-1TLS_CACERTFILE\s0\fR file name" 4
533 .IX Item "TLS_CACERTFILE file name"
534 The path to a certificate authority bundle which contains the certificates
535 for all the Certificate Authorities the client knows to be valid,
536 e.g. \fI/etc/ssl/ca\-bundle.pem\fR.
537 This option is only supported by the OpenLDAP libraries.
538 Netscape-derived \s-1LDAP\s0 libraries use the same certificate
539 database for \s-1CA\s0 and client certificates (see \fB\s-1TLS_CERT\s0\fR).
540 .IP "\fB\s-1TLS_CACERTDIR\s0\fR directory" 4
541 .IX Item "TLS_CACERTDIR directory"
542 Similar to \fB\s-1TLS_CACERTFILE\s0\fR but instead of a file, it is a
543 directory containing individual Certificate Authority certificates,
544 e.g. \fI/etc/ssl/certs\fR.
545 The directory specified by \fB\s-1TLS_CACERTDIR\s0\fR is checked after
546 \&\fB\s-1TLS_CACERTFILE\s0\fR.
547 This option is only supported by the OpenLDAP libraries.
548 .IP "\fB\s-1TLS_CERT\s0\fR file name" 4
549 .IX Item "TLS_CERT file name"
550 The path to a file containing the client certificate which can
551 be used to authenticate the client to the \s-1LDAP\s0 server.
552 The certificate type depends on the \s-1LDAP\s0 libraries used.
555 \f(CW\*(C`tls_cert /etc/ssl/client_cert.pem\*(C'\fR
558 \f(CW\*(C`tls_cert /var/ldap/cert7.db\*(C'\fR
560 When using Netscape-derived libraries, this file may also contain
561 Certificate Authority certificates.
562 .IP "\fB\s-1TLS_KEY\s0\fR file name" 4
563 .IX Item "TLS_KEY file name"
564 The path to a file containing the private key which matches the
565 certificate specified by \fB\s-1TLS_CERT\s0\fR. The private key must not be
566 password-protected. The key type depends on the \s-1LDAP\s0 libraries
570 \f(CW\*(C`tls_key /etc/ssl/client_key.pem\*(C'\fR
573 \f(CW\*(C`tls_key /var/ldap/key3.db\*(C'\fR
574 .IP "\fB\s-1TLS_RANDFILE\s0\fR file name" 4
575 .IX Item "TLS_RANDFILE file name"
576 The \fB\s-1TLS_RANDFILE\s0\fR parameter specifies the path to an entropy
577 source for systems that lack a random device. It is generally used
578 in conjunction with \fIprngd\fR or \fIegd\fR.
579 This option is only supported by the OpenLDAP libraries.
580 .IP "\fB\s-1TLS_CIPHERS\s0\fR cipher list" 4
581 .IX Item "TLS_CIPHERS cipher list"
582 The \fB\s-1TLS_CIPHERS\s0\fR parameter allows the administer to restrict
583 which encryption algorithms may be used for \s-1TLS\s0 (\s-1SSL\s0) connections.
584 See the OpenSSL manual for a list of valid ciphers.
585 This option is only supported by the OpenLDAP libraries.
586 .IP "\fB\s-1USE_SASL\s0\fR on/true/yes/off/false/no" 4
587 .IX Item "USE_SASL on/true/yes/off/false/no"
588 Enable \fB\s-1USE_SASL\s0\fR for \s-1LDAP\s0 servers that support \s-1SASL\s0 authentication.
589 .IP "\fB\s-1SASL_AUTH_ID\s0\fR identity" 4
590 .IX Item "SASL_AUTH_ID identity"
591 The \s-1SASL\s0 user name to use when connecting to the \s-1LDAP\s0 server.
592 By default, \fBsudo\fR will use an anonymous connection.
593 .IP "\fB\s-1ROOTUSE_SASL\s0\fR on/true/yes/off/false/no" 4
594 .IX Item "ROOTUSE_SASL on/true/yes/off/false/no"
595 Enable \fB\s-1ROOTUSE_SASL\s0\fR to enable \s-1SASL\s0 authentication when connecting
596 to an \s-1LDAP\s0 server from a privileged process, such as \fBsudo\fR.
597 .IP "\fB\s-1ROOTSASL_AUTH_ID\s0\fR identity" 4
598 .IX Item "ROOTSASL_AUTH_ID identity"
599 The \s-1SASL\s0 user name to use when \fB\s-1ROOTUSE_SASL\s0\fR is enabled.
600 .IP "\fB\s-1SASL_SECPROPS\s0\fR none/properties" 4
601 .IX Item "SASL_SECPROPS none/properties"
602 \&\s-1SASL\s0 security properties or \fInone\fR for no properties. See the
603 \&\s-1SASL\s0 programmer's manual for details.
604 .IP "\fB\s-1KRB5_CCNAME\s0\fR file name" 4
605 .IX Item "KRB5_CCNAME file name"
606 The path to the Kerberos 5 credential cache to use when authenticating
607 with the remote server.
609 See the \f(CW\*(C`ldap.conf\*(C'\fR entry in the \s-1EXAMPLES\s0 section.
610 .SS "Configuring nsswitch.conf"
611 .IX Subsection "Configuring nsswitch.conf"
612 Unless it is disabled at build time, \fBsudo\fR consults the Name
613 Service Switch file, \fI@nsswitch_conf@\fR, to specify the \fIsudoers\fR
614 search order. Sudo looks for a line beginning with \f(CW\*(C`sudoers\*(C'\fR: and
615 uses this to determine the search order. Note that \fBsudo\fR does
616 not stop searching after the first match and later matches take
617 precedence over earlier ones.
619 The following sources are recognized:
622 \& files read sudoers from F<@sysconfdir@/sudoers>
623 \& ldap read sudoers from LDAP
626 In addition, the entry \f(CW\*(C`[NOTFOUND=return]\*(C'\fR will short-circuit the
627 search if the user was not found in the preceding source.
629 To consult \s-1LDAP\s0 first followed by the local sudoers file (if it
633 \& sudoers: ldap files
636 The local \fIsudoers\fR file can be ignored completely by using:
642 If the \fI@nsswitch_conf@\fR file is not present or there is no
643 sudoers line, the following default is assumed:
649 Note that \fI@nsswitch_conf@\fR is supported even when the underlying
650 operating system does not use an nsswitch.conf file.
651 .SS "Configuring netsvc.conf"
652 .IX Subsection "Configuring netsvc.conf"
653 On \s-1AIX\s0 systems, the \fI@netsvc_conf@\fR file is consulted instead of
654 \&\fI@nsswitch_conf@\fR. \fBsudo\fR simply treats \fInetsvc.conf\fR as a
655 variant of \fInsswitch.conf\fR; information in the previous section
656 unrelated to the file format itself still applies.
658 To consult \s-1LDAP\s0 first followed by the local sudoers file (if it
662 \& sudoers = ldap, files
665 The local \fIsudoers\fR file can be ignored completely by using:
671 To treat \s-1LDAP\s0 as authoratative and only use the local sudoers file
672 if the user is not present in \s-1LDAP\s0, use:
675 \& sudoers = ldap = auth, files
678 Note that in the above example, the \f(CW\*(C`auth\*(C'\fR qualfier only affects
679 user lookups; both \s-1LDAP\s0 and \fIsudoers\fR will be queried for \f(CW\*(C`Defaults\*(C'\fR
682 If the \fI@netsvc_conf@\fR file is not present or there is no
683 sudoers line, the following default is assumed:
690 .ie n .IP "\fI@ldap_conf@\fR" 24
691 .el .IP "\fI@ldap_conf@\fR" 24
692 .IX Item "@ldap_conf@"
693 \&\s-1LDAP\s0 configuration file
694 .ie n .IP "\fI@nsswitch_conf@\fR" 24
695 .el .IP "\fI@nsswitch_conf@\fR" 24
696 .IX Item "@nsswitch_conf@"
697 determines sudoers source order
698 .ie n .IP "\fI@netsvc_conf@\fR" 24
699 .el .IP "\fI@netsvc_conf@\fR" 24
700 .IX Item "@netsvc_conf@"
701 determines sudoers source order on \s-1AIX\s0
703 .IX Header "EXAMPLES"
704 .SS "Example ldap.conf"
705 .IX Subsection "Example ldap.conf"
707 \& # Either specify one or more URIs or one or more host:port pairs.
708 \& # If neither is specified sudo will default to localhost, port 389.
711 \& #host ldapserver1 ldapserver2:390
713 \& # Default port if host is specified without one, defaults to 389.
716 \& # URI will override the host and port settings.
717 \& uri ldap://ldapserver
718 \& #uri ldaps://secureldapserver
719 \& #uri ldaps://secureldapserver ldap://ldapserver
721 \& # The amount of time, in seconds, to wait while trying to connect to
725 \& # The amount of time, in seconds, to wait while performing an LDAP query.
728 \& # Must be set or sudo will ignore LDAP; may be specified multiple times.
729 \& sudoers_base ou=SUDOers,dc=example,dc=com
731 \& # verbose sudoers matching from ldap
734 \& # Enable support for time\-based entries in sudoers.
735 \& #sudoers_timed yes
737 \& # optional proxy credentials
738 \& #binddn <who to search as>
739 \& #bindpw <password>
740 \& #rootbinddn <who to search as, uses /etc/ldap.secret for bindpw>
742 \& # LDAP protocol version, defaults to 3
745 \& # Define if you want to use an encrypted LDAP connection.
746 \& # Typically, you must also set the port to 636 (ldaps).
749 \& # Define if you want to use port 389 and switch to
750 \& # encryption before the bind credentials are sent.
751 \& # Only supported by LDAP servers that support the start_tls
752 \& # extension such as OpenLDAP.
755 \& # Additional TLS options follow that allow tweaking of the
756 \& # SSL/TLS connection.
758 \& #tls_checkpeer yes # verify server SSL certificate
759 \& #tls_checkpeer no # ignore server SSL certificate
761 \& # If you enable tls_checkpeer, specify either tls_cacertfile
762 \& # or tls_cacertdir. Only supported when using OpenLDAP.
764 \& #tls_cacertfile /etc/certs/trusted_signers.pem
765 \& #tls_cacertdir /etc/certs
767 \& # For systems that don\*(Aqt have /dev/random
768 \& # use this along with PRNGD or EGD.pl to seed the
769 \& # random number pool to generate cryptographic session keys.
770 \& # Only supported when using OpenLDAP.
772 \& #tls_randfile /etc/egd\-pool
774 \& # You may restrict which ciphers are used. Consult your SSL
775 \& # documentation for which options go here.
776 \& # Only supported when using OpenLDAP.
778 \& #tls_ciphers <cipher\-list>
780 \& # Sudo can provide a client certificate when communicating to
781 \& # the LDAP server.
783 \& # * Enable both lines at the same time.
784 \& # * Do not password protect the key file.
785 \& # * Ensure the keyfile is only readable by root.
788 \& #tls_cert /etc/certs/client_cert.pem
789 \& #tls_key /etc/certs/client_key.pem
791 \& # For SunONE or iPlanet LDAP, tls_cert and tls_key may specify either
792 \& # a directory, in which case the files in the directory must have the
793 \& # default names (e.g. cert8.db and key4.db), or the path to the cert
794 \& # and key files themselves. However, a bug in version 5.0 of the LDAP
795 \& # SDK will prevent specific file names from working. For this reason
796 \& # it is suggested that tls_cert and tls_key be set to a directory,
797 \& # not a file name.
799 \& # The certificate database specified by tls_cert may contain CA certs
800 \& # and/or the client\*(Aqs cert. If the client\*(Aqs cert is included, tls_key
801 \& # should be specified as well.
802 \& # For backward compatibility, "sslpath" may be used in place of tls_cert.
803 \& #tls_cert /var/ldap
804 \& #tls_key /var/ldap
806 \& # If using SASL authentication for LDAP (OpenSSL)
808 \& # sasl_auth_id <SASL user name>
809 \& # rootuse_sasl yes
810 \& # rootsasl_auth_id <SASL user name for root access>
811 \& # sasl_secprops none
812 \& # krb5_ccname /etc/.ldapcache
814 .SS "Sudo schema for OpenLDAP"
815 .IX Subsection "Sudo schema for OpenLDAP"
816 The following schema, in OpenLDAP format, is included with \fBsudo\fR
817 source and binary distributions as \fIschema.OpenLDAP\fR. Simply copy
818 it to the schema directory (e.g. \fI/etc/openldap/schema\fR), add the
819 proper \f(CW\*(C`include\*(C'\fR line in \f(CW\*(C`slapd.conf\*(C'\fR and restart \fBslapd\fR.
822 \& attributetype ( 1.3.6.1.4.1.15953.9.1.1
823 \& NAME \*(AqsudoUser\*(Aq
824 \& DESC \*(AqUser(s) who may run sudo\*(Aq
825 \& EQUALITY caseExactIA5Match
826 \& SUBSTR caseExactIA5SubstringsMatch
827 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
829 \& attributetype ( 1.3.6.1.4.1.15953.9.1.2
830 \& NAME \*(AqsudoHost\*(Aq
831 \& DESC \*(AqHost(s) who may run sudo\*(Aq
832 \& EQUALITY caseExactIA5Match
833 \& SUBSTR caseExactIA5SubstringsMatch
834 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
836 \& attributetype ( 1.3.6.1.4.1.15953.9.1.3
837 \& NAME \*(AqsudoCommand\*(Aq
838 \& DESC \*(AqCommand(s) to be executed by sudo\*(Aq
839 \& EQUALITY caseExactIA5Match
840 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
842 \& attributetype ( 1.3.6.1.4.1.15953.9.1.4
843 \& NAME \*(AqsudoRunAs\*(Aq
844 \& DESC \*(AqUser(s) impersonated by sudo\*(Aq
845 \& EQUALITY caseExactIA5Match
846 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
848 \& attributetype ( 1.3.6.1.4.1.15953.9.1.5
849 \& NAME \*(AqsudoOption\*(Aq
850 \& DESC \*(AqOptions(s) followed by sudo\*(Aq
851 \& EQUALITY caseExactIA5Match
852 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
854 \& attributetype ( 1.3.6.1.4.1.15953.9.1.6
855 \& NAME \*(AqsudoRunAsUser\*(Aq
856 \& DESC \*(AqUser(s) impersonated by sudo\*(Aq
857 \& EQUALITY caseExactIA5Match
858 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
860 \& attributetype ( 1.3.6.1.4.1.15953.9.1.7
861 \& NAME \*(AqsudoRunAsGroup\*(Aq
862 \& DESC \*(AqGroup(s) impersonated by sudo\*(Aq
863 \& EQUALITY caseExactIA5Match
864 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
866 \& attributetype ( 1.3.6.1.4.1.15953.9.1.8
867 \& NAME \*(AqsudoNotBefore\*(Aq
868 \& DESC \*(AqStart of time interval for which the entry is valid\*(Aq
869 \& EQUALITY generalizedTimeMatch
870 \& ORDERING generalizedTimeOrderingMatch
871 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
873 \& attributetype ( 1.3.6.1.4.1.15953.9.1.9
874 \& NAME \*(AqsudoNotAfter\*(Aq
875 \& DESC \*(AqEnd of time interval for which the entry is valid\*(Aq
876 \& EQUALITY generalizedTimeMatch
877 \& ORDERING generalizedTimeOrderingMatch
878 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
880 \& attributeTypes ( 1.3.6.1.4.1.15953.9.1.10
881 \& NAME \*(AqsudoOrder\*(Aq
882 \& DESC \*(Aqan integer to order the sudoRole entries\*(Aq
883 \& EQUALITY integerMatch
884 \& ORDERING integerOrderingMatch
885 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
887 \& objectclass ( 1.3.6.1.4.1.15953.9.2.1 NAME \*(AqsudoRole\*(Aq SUP top STRUCTURAL
888 \& DESC \*(AqSudoer Entries\*(Aq
890 \& MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $
891 \& sudoRunAsGroup $ sudoOption $ sudoNotBefore $ sudoNotAfter $
892 \& sudoOrder $ description )
896 .IX Header "SEE ALSO"
897 \&\fIldap.conf\fR\|(@mansectform@), \fIsudoers\fR\|(5)
900 Note that there are differences in the way that LDAP-based \fIsudoers\fR
901 is parsed compared to file-based \fIsudoers\fR. See the \*(L"Differences
902 between \s-1LDAP\s0 and non-LDAP sudoers\*(R" section for more information.
905 If you feel you have found a bug in \fBsudo\fR, please submit a bug report
906 at http://www.sudo.ws/sudo/bugs/
909 Limited free support is available via the sudo-users mailing list,
910 see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
913 .IX Header "DISCLAIMER"
914 \&\fBsudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
915 including, but not limited to, the implied warranties of merchantability
916 and fitness for a particular purpose are disclaimed. See the \s-1LICENSE\s0
917 file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
918 for complete details.
projects / debian / sudo / blob