1 .\" Copyright (c) 2003-2011
2 .\" Todd C. Miller <Todd.Miller@courtesan.com>
4 .\" Permission to use, copy, modify, and distribute this software for any
5 .\" purpose with or without fee is hereby granted, provided that the above
6 .\" copyright notice and this permission notice appear in all copies.
8 .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
17 .\" Automatically generated by Pod::Man 2.23 (Pod::Simple 3.14)
19 .\" Standard preamble:
20 .\" ========================================================================
21 .de Sp \" Vertical space (when we can't use .PP)
25 .de Vb \" Begin verbatim text
30 .de Ve \" End verbatim text
34 .\" Set up some character translations and predefined strings. \*(-- will
35 .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
36 .\" double quote, and \*(R" will give a right double quote. \*(C+ will
37 .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
38 .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
39 .\" nothing in troff, for use with C<>.
41 .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
45 . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
46 . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
59 .\" Escape single quotes in literal strings from groff's Unicode transform.
63 .\" If the F register is turned on, we'll generate index entries on stderr for
64 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
65 .\" entries marked with X<> in POD. Of course, you'll have to process the
66 .\" output yourself in some meaningful fashion.
69 . tm Index:\\$1\t\\n%\t"\\$2"
79 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
80 .\" Fear. Run. Save yourself. No user-serviceable parts.
81 . \" fudge factors for nroff and troff
90 . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
96 . \" simple accents for nroff and troff
106 . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
107 . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
108 . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
109 . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
110 . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
111 . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
113 . \" troff and (daisy-wheel) nroff accents
114 .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
115 .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
116 .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
117 .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
118 .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
119 .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
120 .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
121 .ds ae a\h'-(\w'a'u*4/10)'e
122 .ds Ae A\h'-(\w'A'u*4/10)'E
123 . \" corrections for vroff
124 .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
125 .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
126 . \" for low resolution devices (crt and lpr)
127 .if \n(.H>23 .if \n(.V>19 \
140 .\" ========================================================================
142 .IX Title "SUDOERS.LDAP @mansectform@"
143 .TH SUDOERS.LDAP @mansectform@ "September 16, 2011" "1.8.3" "MAINTENANCE COMMANDS"
144 .\" For nroff, turn off justification. Always turn off hyphenation; it makes
145 .\" way too many mistakes in technical documents.
149 sudoers.ldap \- sudo LDAP configuration
151 .IX Header "DESCRIPTION"
152 In addition to the standard \fIsudoers\fR file, \fBsudo\fR may be configured
153 via \s-1LDAP\s0. This can be especially useful for synchronizing \fIsudoers\fR
154 in a large, distributed environment.
156 Using \s-1LDAP\s0 for \fIsudoers\fR has several benefits:
158 \&\fBsudo\fR no longer needs to read \fIsudoers\fR in its entirety. When
159 \&\s-1LDAP\s0 is used, there are only two or three \s-1LDAP\s0 queries per invocation.
160 This makes it especially fast and particularly usable in \s-1LDAP\s0
163 \&\fBsudo\fR no longer exits if there is a typo in \fIsudoers\fR.
164 It is not possible to load \s-1LDAP\s0 data into the server that does
165 not conform to the sudoers schema, so proper syntax is guaranteed.
166 It is still possible to have typos in a user or host name, but
167 this will not prevent \fBsudo\fR from running.
169 It is possible to specify per-entry options that override the global
170 default options. \fI@sysconfdir@/sudoers\fR only supports default options and
171 limited options associated with user/host/commands/aliases. The
172 syntax is complicated and can be difficult for users to understand.
173 Placing the options directly in the entry is more natural.
175 The \fBvisudo\fR program is no longer needed. \fBvisudo\fR provides
176 locking and syntax checking of the \fI@sysconfdir@/sudoers\fR file.
177 Since \s-1LDAP\s0 updates are atomic, locking is no longer necessary.
178 Because syntax is checked when the data is inserted into \s-1LDAP\s0, there
179 is no need for a specialized tool to check syntax.
181 Another major difference between \s-1LDAP\s0 and file-based \fIsudoers\fR
182 is that in \s-1LDAP\s0, \fBsudo\fR\-specific Aliases are not supported.
184 For the most part, there is really no need for \fBsudo\fR\-specific
185 Aliases. Unix groups or user netgroups can be used in place of
186 User_Aliases and Runas_Aliases. Host netgroups can be used in place
187 of Host_Aliases. Since Unix groups and netgroups can also be stored
188 in \s-1LDAP\s0 there is no real need for \fBsudo\fR\-specific aliases.
190 Cmnd_Aliases are not really required either since it is possible
191 to have multiple users listed in a \f(CW\*(C`sudoRole\*(C'\fR. Instead of defining
192 a Cmnd_Alias that is referenced by multiple users, one can create
193 a \f(CW\*(C`sudoRole\*(C'\fR that contains the commands and assign multiple users
195 .SS "SUDOers \s-1LDAP\s0 container"
196 .IX Subsection "SUDOers LDAP container"
197 The \fIsudoers\fR configuration is contained in the \f(CW\*(C`ou=SUDOers\*(C'\fR \s-1LDAP\s0
200 Sudo first looks for the \f(CW\*(C`cn=default\*(C'\fR entry in the SUDOers container.
201 If found, the multi-valued \f(CW\*(C`sudoOption\*(C'\fR attribute is parsed in the
202 same manner as a global \f(CW\*(C`Defaults\*(C'\fR line in \fI@sysconfdir@/sudoers\fR. In
203 the following example, the \f(CW\*(C`SSH_AUTH_SOCK\*(C'\fR variable will be preserved
204 in the environment for all users.
207 \& dn: cn=defaults,ou=SUDOers,dc=example,dc=com
209 \& objectClass: sudoRole
211 \& description: Default sudoOption\*(Aqs go here
212 \& sudoOption: env_keep+=SSH_AUTH_SOCK
215 The equivalent of a sudoer in \s-1LDAP\s0 is a \f(CW\*(C`sudoRole\*(C'\fR. It consists of
216 the following attributes:
217 .IP "\fBsudoUser\fR" 4
219 A user name, uid (prefixed with \f(CW\*(Aq#\*(Aq\fR), Unix group (prefixed with
220 a \f(CW\*(Aq%\*(Aq\fR) or user netgroup (prefixed with a \f(CW\*(Aq+\*(Aq\fR).
221 .IP "\fBsudoHost\fR" 4
223 A host name, \s-1IP\s0 address, \s-1IP\s0 network, or host netgroup (prefixed
224 with a \f(CW\*(Aq+\*(Aq\fR).
225 The special value \f(CW\*(C`ALL\*(C'\fR will match any host.
226 .IP "\fBsudoCommand\fR" 4
227 .IX Item "sudoCommand"
228 A Unix command with optional command line arguments, potentially
229 including globbing characters (aka wild cards).
230 The special value \f(CW\*(C`ALL\*(C'\fR will match any command.
231 If a command is prefixed with an exclamation point \f(CW\*(Aq!\*(Aq\fR, the
232 user will be prohibited from running that command.
233 .IP "\fBsudoOption\fR" 4
234 .IX Item "sudoOption"
235 Identical in function to the global options described above, but
236 specific to the \f(CW\*(C`sudoRole\*(C'\fR in which it resides.
237 .IP "\fBsudoRunAsUser\fR" 4
238 .IX Item "sudoRunAsUser"
239 A user name or uid (prefixed with \f(CW\*(Aq#\*(Aq\fR) that commands may be run
240 as or a Unix group (prefixed with a \f(CW\*(Aq%\*(Aq\fR) or user netgroup (prefixed
241 with a \f(CW\*(Aq+\*(Aq\fR) that contains a list of users that commands may be
243 The special value \f(CW\*(C`ALL\*(C'\fR will match any user.
245 The \f(CW\*(C`sudoRunAsUser\*(C'\fR attribute is only available in \fBsudo\fR versions
246 1.7.0 and higher. Older versions of \fBsudo\fR use the \f(CW\*(C`sudoRunAs\*(C'\fR
248 .IP "\fBsudoRunAsGroup\fR" 4
249 .IX Item "sudoRunAsGroup"
250 A Unix group or gid (prefixed with \f(CW\*(Aq#\*(Aq\fR) that commands may be run as.
251 The special value \f(CW\*(C`ALL\*(C'\fR will match any group.
253 The \f(CW\*(C`sudoRunAsGroup\*(C'\fR attribute is only available in \fBsudo\fR versions
255 .IP "\fBsudoNotBefore\fR" 4
256 .IX Item "sudoNotBefore"
257 A timestamp in the form \f(CW\*(C`yyyymmddHHMMSSZ\*(C'\fR that can be used to provide
258 a start date/time for when the \f(CW\*(C`sudoRole\*(C'\fR will be valid. If
259 multiple \f(CW\*(C`sudoNotBefore\*(C'\fR entries are present, the earliest is used.
260 Note that timestamps must be in Coordinated Universal Time (\s-1UTC\s0),
261 not the local timezone. The minute and seconds portions are optional,
262 but some \s-1LDAP\s0 servers require that they be present (contrary to the \s-1RFC\s0).
264 The \f(CW\*(C`sudoNotBefore\*(C'\fR attribute is only available in \fBsudo\fR versions
265 1.7.5 and higher and must be explicitly enabled via the \fB\s-1SUDOERS_TIMED\s0\fR
266 option in \fI@ldap_conf@\fR.
267 .IP "\fBsudoNotAfter\fR" 4
268 .IX Item "sudoNotAfter"
269 A timestamp in the form \f(CW\*(C`yyyymmddHHMMSSZ\*(C'\fR that indicates an expiration
270 date/time, after which the \f(CW\*(C`sudoRole\*(C'\fR will no longer be valid. If
271 multiple \f(CW\*(C`sudoNotBefore\*(C'\fR entries are present, the last one is used.
272 Note that timestamps must be in Coordinated Universal Time (\s-1UTC\s0),
273 not the local timezone. The minute and seconds portions are optional,
274 but some \s-1LDAP\s0 servers require that they be present (contrary to the \s-1RFC\s0).
276 The \f(CW\*(C`sudoNotAfter\*(C'\fR attribute is only available in \fBsudo\fR versions
277 1.7.5 and higher and must be explicitly enabled via the \fB\s-1SUDOERS_TIMED\s0\fR
278 option in \fI@ldap_conf@\fR.
279 .IP "\fBsudoOrder\fR" 4
281 The \f(CW\*(C`sudoRole\*(C'\fR entries retrieved from the \s-1LDAP\s0 directory have no
282 inherent order. The \f(CW\*(C`sudoOrder\*(C'\fR attribute is an integer (or
283 floating point value for \s-1LDAP\s0 servers that support it) that is used
284 to sort the matching entries. This allows LDAP-based sudoers entries
285 to more closely mimic the behaviour of the sudoers file, where the
286 of the entries influences the result. If multiple entries match,
287 the entry with the highest \f(CW\*(C`sudoOrder\*(C'\fR attribute is chosen. This
288 corresponds to the \*(L"last match\*(R" behavior of the sudoers file. If
289 the \f(CW\*(C`sudoOrder\*(C'\fR attribute is not present, a value of 0 is assumed.
291 The \f(CW\*(C`sudoOrder\*(C'\fR attribute is only available in \fBsudo\fR versions
294 Each attribute listed above should contain a single value, but there
295 may be multiple instances of each attribute type. A \f(CW\*(C`sudoRole\*(C'\fR must
296 contain at least one \f(CW\*(C`sudoUser\*(C'\fR, \f(CW\*(C`sudoHost\*(C'\fR and \f(CW\*(C`sudoCommand\*(C'\fR.
298 The following example allows users in group wheel to run any command
299 on any host via \fBsudo\fR:
302 \& dn: cn=%wheel,ou=SUDOers,dc=example,dc=com
304 \& objectClass: sudoRole
310 .SS "Anatomy of \s-1LDAP\s0 sudoers lookup"
311 .IX Subsection "Anatomy of LDAP sudoers lookup"
312 When looking up a sudoer using \s-1LDAP\s0 there are only two or three
313 \&\s-1LDAP\s0 queries per invocation. The first query is to parse the global
314 options. The second is to match against the user's name and the
315 groups that the user belongs to. (The special \s-1ALL\s0 tag is matched
316 in this query too.) If no match is returned for the user's name
317 and groups, a third query returns all entries containing user
318 netgroups and checks to see if the user belongs to any of them.
320 If timed entries are enabled with the \fB\s-1SUDOERS_TIMED\s0\fR configuration
321 directive, the \s-1LDAP\s0 queries include a subfilter that limits retrieval
322 to entries that satisfy the time constraints, if any.
323 .SS "Differences between \s-1LDAP\s0 and non-LDAP sudoers"
324 .IX Subsection "Differences between LDAP and non-LDAP sudoers"
325 There are some subtle differences in the way sudoers is handled
326 once in \s-1LDAP\s0. Probably the biggest is that according to the \s-1RFC\s0,
327 \&\s-1LDAP\s0 ordering is arbitrary and you cannot expect that Attributes
328 and Entries are returned in any specific order.
330 The order in which different entries are applied can be controlled
331 using the \f(CW\*(C`sudoOrder\*(C'\fR attribute, but there is no way to guarantee
332 the order of attributes within a specific entry. If there are
333 conflicting command rules in an entry, the negative takes precedence.
334 This is called paranoid behavior (not necessarily the most specific
341 \& # Allow all commands except shell
342 \& johnny ALL=(root) ALL,!/bin/sh
343 \& # Always allows all commands because ALL is matched last
344 \& puddles ALL=(root) !/bin/sh,ALL
346 \& # LDAP equivalent of johnny
347 \& # Allows all commands except shell
348 \& dn: cn=role1,ou=Sudoers,dc=my\-domain,dc=com
349 \& objectClass: sudoRole
355 \& sudoCommand: !/bin/sh
357 \& # LDAP equivalent of puddles
358 \& # Notice that even though ALL comes last, it still behaves like
359 \& # role1 since the LDAP code assumes the more paranoid configuration
360 \& dn: cn=role2,ou=Sudoers,dc=my\-domain,dc=com
361 \& objectClass: sudoRole
366 \& sudoCommand: !/bin/sh
370 Another difference is that negations on the Host, User or Runas are
371 currently ignored. For example, the following attributes do not
372 behave the way one might expect.
375 \& # does not match all but joe
376 \& # rather, does not match anyone
379 \& # does not match all but joe
380 \& # rather, matches everyone including Joe
384 \& # does not match all but web01
385 \& # rather, matches all hosts including web01
390 .IX Subsection "Sudoers Schema"
391 In order to use \fBsudo\fR's \s-1LDAP\s0 support, the \fBsudo\fR schema must be
392 installed on your \s-1LDAP\s0 server. In addition, be sure to index the
393 \&'sudoUser' attribute.
395 Three versions of the schema: one for OpenLDAP servers (\fIschema.OpenLDAP\fR),
396 one for Netscape-derived servers (\fIschema.iPlanet\fR), and one for
397 Microsoft Active Directory (\fIschema.ActiveDirectory\fR) may
398 be found in the \fBsudo\fR distribution.
400 The schema for \fBsudo\fR in OpenLDAP form is included in the \s-1EXAMPLES\s0
402 .SS "Configuring ldap.conf"
403 .IX Subsection "Configuring ldap.conf"
404 Sudo reads the \fI@ldap_conf@\fR file for LDAP-specific configuration.
405 Typically, this file is shared amongst different LDAP-aware clients.
406 As such, most of the settings are not \fBsudo\fR\-specific. Note that
407 \&\fBsudo\fR parses \fI@ldap_conf@\fR itself and may support options
408 that differ from those described in the \fIldap.conf\fR\|(@mansectform@) manual.
410 Also note that on systems using the OpenLDAP libraries, default
411 values specified in \fI/etc/openldap/ldap.conf\fR or the user's
412 \&\fI.ldaprc\fR files are not used.
414 Only those options explicitly listed in \fI@ldap_conf@\fR as being
415 supported by \fBsudo\fR are honored. Configuration options are listed
416 below in upper case but are parsed in a case-independent manner.
417 .IP "\fB\s-1URI\s0\fR ldap[s]://[hostname[:port]] ..." 4
418 .IX Item "URI ldap[s]://[hostname[:port]] ..."
419 Specifies a whitespace-delimited list of one or more URIs describing
420 the \s-1LDAP\s0 server(s) to connect to. The \fIprotocol\fR may be either
421 \&\fBldap\fR or \fBldaps\fR, the latter being for servers that support \s-1TLS\s0
422 (\s-1SSL\s0) encryption. If no \fIport\fR is specified, the default is port
423 389 for \f(CW\*(C`ldap://\*(C'\fR or port 636 for \f(CW\*(C`ldaps://\*(C'\fR. If no \fIhostname\fR
424 is specified, \fBsudo\fR will connect to \fBlocalhost\fR. Multiple \fB\s-1URI\s0\fR
425 lines are treated identically to a \fB\s-1URI\s0\fR line containing multiple
426 entries. Only systems using the OpenSSL libraries support the
427 mixing of \f(CW\*(C`ldap://\*(C'\fR and \f(CW\*(C`ldaps://\*(C'\fR URIs. The Netscape-derived
428 libraries used on most commercial versions of Unix are only capable
429 of supporting one or the other.
430 .IP "\fB\s-1HOST\s0\fR name[:port] ..." 4
431 .IX Item "HOST name[:port] ..."
432 If no \fB\s-1URI\s0\fR is specified, the \fB\s-1HOST\s0\fR parameter specifies a
433 whitespace-delimited list of \s-1LDAP\s0 servers to connect to. Each host
434 may include an optional \fIport\fR separated by a colon (':'). The
435 \&\fB\s-1HOST\s0\fR parameter is deprecated in favor of the \fB\s-1URI\s0\fR specification
436 and is included for backwards compatibility.
437 .IP "\fB\s-1PORT\s0\fR port_number" 4
438 .IX Item "PORT port_number"
439 If no \fB\s-1URI\s0\fR is specified, the \fB\s-1PORT\s0\fR parameter specifies the
440 default port to connect to on the \s-1LDAP\s0 server if a \fB\s-1HOST\s0\fR parameter
441 does not specify the port itself. If no \fB\s-1PORT\s0\fR parameter is used,
442 the default is port 389 for \s-1LDAP\s0 and port 636 for \s-1LDAP\s0 over \s-1TLS\s0
443 (\s-1SSL\s0). The \fB\s-1PORT\s0\fR parameter is deprecated in favor of the \fB\s-1URI\s0\fR
444 specification and is included for backwards compatibility.
445 .IP "\fB\s-1BIND_TIMELIMIT\s0\fR seconds" 4
446 .IX Item "BIND_TIMELIMIT seconds"
447 The \fB\s-1BIND_TIMELIMIT\s0\fR parameter specifies the amount of time, in seconds,
448 to wait while trying to connect to an \s-1LDAP\s0 server. If multiple \fB\s-1URI\s0\fRs or
449 \&\fB\s-1HOST\s0\fRs are specified, this is the amount of time to wait before trying
450 the next one in the list.
451 .IP "\fB\s-1NETWORK_TIMEOUT\s0\fR seconds" 4
452 .IX Item "NETWORK_TIMEOUT seconds"
453 An alias for \fB\s-1BIND_TIMELIMIT\s0\fR for OpenLDAP compatibility.
454 .IP "\fB\s-1TIMELIMIT\s0\fR seconds" 4
455 .IX Item "TIMELIMIT seconds"
456 The \fB\s-1TIMELIMIT\s0\fR parameter specifies the amount of time, in seconds,
457 to wait for a response to an \s-1LDAP\s0 query.
458 .IP "\fB\s-1TIMEOUT\s0\fR seconds" 4
459 .IX Item "TIMEOUT seconds"
460 The \fB\s-1TIMEOUT\s0\fR parameter specifies the amount of time, in seconds,
461 to wait for a response from the various \s-1LDAP\s0 APIs.
462 .IP "\fB\s-1SUDOERS_BASE\s0\fR base" 4
463 .IX Item "SUDOERS_BASE base"
464 The base \s-1DN\s0 to use when performing \fBsudo\fR \s-1LDAP\s0 queries. Typically
465 this is of the form \f(CW\*(C`ou=SUDOers,dc=example,dc=com\*(C'\fR for the domain
466 \&\f(CW\*(C`example.com\*(C'\fR. Multiple \fB\s-1SUDOERS_BASE\s0\fR lines may be specified,
467 in which case they are queried in the order specified.
468 .IP "\fB\s-1SUDOERS_SEARCH_FILTER\s0\fR ldap_filter" 4
469 .IX Item "SUDOERS_SEARCH_FILTER ldap_filter"
470 An \s-1LDAP\s0 filter which is used to restrict the set of records returned
471 when performing a \fBsudo\fR \s-1LDAP\s0 query. Typically, this is of the
472 form \f(CW\*(C`attribute=value\*(C'\fR or \f(CW\*(C`(&(attribute=value)(attribute2=value2))\*(C'\fR.
473 .IP "\fB\s-1SUDOERS_TIMED\s0\fR on/true/yes/off/false/no" 4
474 .IX Item "SUDOERS_TIMED on/true/yes/off/false/no"
475 Whether or not to evaluate the \f(CW\*(C`sudoNotBefore\*(C'\fR and \f(CW\*(C`sudoNotAfter\*(C'\fR
476 attributes that implement time-dependent sudoers entries.
477 .IP "\fB\s-1SUDOERS_DEBUG\s0\fR debug_level" 4
478 .IX Item "SUDOERS_DEBUG debug_level"
479 This sets the debug level for \fBsudo\fR \s-1LDAP\s0 queries. Debugging
480 information is printed to the standard error. A value of 1 results
481 in a moderate amount of debugging information. A value of 2 shows
482 the results of the matches themselves. This parameter should not
483 be set in a production environment as the extra information is
484 likely to confuse users.
485 .IP "\fB\s-1BINDDN\s0\fR \s-1DN\s0" 4
487 The \fB\s-1BINDDN\s0\fR parameter specifies the identity, in the form of a
488 Distinguished Name (\s-1DN\s0), to use when performing \s-1LDAP\s0 operations.
489 If not specified, \s-1LDAP\s0 operations are performed with an anonymous
490 identity. By default, most \s-1LDAP\s0 servers will allow anonymous access.
491 .IP "\fB\s-1BINDPW\s0\fR secret" 4
492 .IX Item "BINDPW secret"
493 The \fB\s-1BINDPW\s0\fR parameter specifies the password to use when performing
494 \&\s-1LDAP\s0 operations. This is typically used in conjunction with the
495 \&\fB\s-1BINDDN\s0\fR parameter.
496 .IP "\fB\s-1ROOTBINDDN\s0\fR \s-1DN\s0" 4
497 .IX Item "ROOTBINDDN DN"
498 The \fB\s-1ROOTBINDDN\s0\fR parameter specifies the identity, in the form of
499 a Distinguished Name (\s-1DN\s0), to use when performing privileged \s-1LDAP\s0
500 operations, such as \fIsudoers\fR queries. The password corresponding
501 to the identity should be stored in \fI@ldap_secret@\fR.
502 If not specified, the \fB\s-1BINDDN\s0\fR identity is used (if any).
503 .IP "\fB\s-1LDAP_VERSION\s0\fR number" 4
504 .IX Item "LDAP_VERSION number"
505 The version of the \s-1LDAP\s0 protocol to use when connecting to the server.
506 The default value is protocol version 3.
507 .IP "\fB\s-1SSL\s0\fR on/true/yes/off/false/no" 4
508 .IX Item "SSL on/true/yes/off/false/no"
509 If the \fB\s-1SSL\s0\fR parameter is set to \f(CW\*(C`on\*(C'\fR, \f(CW\*(C`true\*(C'\fR or \f(CW\*(C`yes\*(C'\fR, \s-1TLS\s0
510 (\s-1SSL\s0) encryption is always used when communicating with the \s-1LDAP\s0
511 server. Typically, this involves connecting to the server on port
513 .IP "\fB\s-1SSL\s0\fR start_tls" 4
514 .IX Item "SSL start_tls"
515 If the \fB\s-1SSL\s0\fR parameter is set to \f(CW\*(C`start_tls\*(C'\fR, the \s-1LDAP\s0 server
516 connection is initiated normally and \s-1TLS\s0 encryption is begun before
517 the bind credentials are sent. This has the advantage of not
518 requiring a dedicated port for encrypted communications. This
519 parameter is only supported by \s-1LDAP\s0 servers that honor the \f(CW\*(C`start_tls\*(C'\fR
520 extension, such as the OpenLDAP server.
521 .IP "\fB\s-1TLS_CHECKPEER\s0\fR on/true/yes/off/false/no" 4
522 .IX Item "TLS_CHECKPEER on/true/yes/off/false/no"
523 If enabled, \fB\s-1TLS_CHECKPEER\s0\fR will cause the \s-1LDAP\s0 server's \s-1TLS\s0
524 certificated to be verified. If the server's \s-1TLS\s0 certificate cannot
525 be verified (usually because it is signed by an unknown certificate
526 authority), \fBsudo\fR will be unable to connect to it. If \fB\s-1TLS_CHECKPEER\s0\fR
527 is disabled, no check is made. Note that disabling the check creates
528 an opportunity for man-in-the-middle attacks since the server's
529 identity will not be authenticated. If possible, the \s-1CA\s0's certificate
530 should be installed locally so it can be verified.
531 .IP "\fB\s-1TLS_CACERT\s0\fR file name" 4
532 .IX Item "TLS_CACERT file name"
533 An alias for \fB\s-1TLS_CACERTFILE\s0\fR for OpenLDAP compatibility.
534 .IP "\fB\s-1TLS_CACERTFILE\s0\fR file name" 4
535 .IX Item "TLS_CACERTFILE file name"
536 The path to a certificate authority bundle which contains the certificates
537 for all the Certificate Authorities the client knows to be valid,
538 e.g. \fI/etc/ssl/ca\-bundle.pem\fR.
539 This option is only supported by the OpenLDAP libraries.
540 Netscape-derived \s-1LDAP\s0 libraries use the same certificate
541 database for \s-1CA\s0 and client certificates (see \fB\s-1TLS_CERT\s0\fR).
542 .IP "\fB\s-1TLS_CACERTDIR\s0\fR directory" 4
543 .IX Item "TLS_CACERTDIR directory"
544 Similar to \fB\s-1TLS_CACERTFILE\s0\fR but instead of a file, it is a
545 directory containing individual Certificate Authority certificates,
546 e.g. \fI/etc/ssl/certs\fR.
547 The directory specified by \fB\s-1TLS_CACERTDIR\s0\fR is checked after
548 \&\fB\s-1TLS_CACERTFILE\s0\fR.
549 This option is only supported by the OpenLDAP libraries.
550 .IP "\fB\s-1TLS_CERT\s0\fR file name" 4
551 .IX Item "TLS_CERT file name"
552 The path to a file containing the client certificate which can
553 be used to authenticate the client to the \s-1LDAP\s0 server.
554 The certificate type depends on the \s-1LDAP\s0 libraries used.
557 \f(CW\*(C`tls_cert /etc/ssl/client_cert.pem\*(C'\fR
560 \f(CW\*(C`tls_cert /var/ldap/cert7.db\*(C'\fR
562 When using Netscape-derived libraries, this file may also contain
563 Certificate Authority certificates.
564 .IP "\fB\s-1TLS_KEY\s0\fR file name" 4
565 .IX Item "TLS_KEY file name"
566 The path to a file containing the private key which matches the
567 certificate specified by \fB\s-1TLS_CERT\s0\fR. The private key must not be
568 password-protected. The key type depends on the \s-1LDAP\s0 libraries
572 \f(CW\*(C`tls_key /etc/ssl/client_key.pem\*(C'\fR
575 \f(CW\*(C`tls_key /var/ldap/key3.db\*(C'\fR
576 .IP "\fB\s-1TLS_RANDFILE\s0\fR file name" 4
577 .IX Item "TLS_RANDFILE file name"
578 The \fB\s-1TLS_RANDFILE\s0\fR parameter specifies the path to an entropy
579 source for systems that lack a random device. It is generally used
580 in conjunction with \fIprngd\fR or \fIegd\fR.
581 This option is only supported by the OpenLDAP libraries.
582 .IP "\fB\s-1TLS_CIPHERS\s0\fR cipher list" 4
583 .IX Item "TLS_CIPHERS cipher list"
584 The \fB\s-1TLS_CIPHERS\s0\fR parameter allows the administer to restrict
585 which encryption algorithms may be used for \s-1TLS\s0 (\s-1SSL\s0) connections.
586 See the OpenSSL manual for a list of valid ciphers.
587 This option is only supported by the OpenLDAP libraries.
588 .IP "\fB\s-1USE_SASL\s0\fR on/true/yes/off/false/no" 4
589 .IX Item "USE_SASL on/true/yes/off/false/no"
590 Enable \fB\s-1USE_SASL\s0\fR for \s-1LDAP\s0 servers that support \s-1SASL\s0 authentication.
591 .IP "\fB\s-1SASL_AUTH_ID\s0\fR identity" 4
592 .IX Item "SASL_AUTH_ID identity"
593 The \s-1SASL\s0 user name to use when connecting to the \s-1LDAP\s0 server.
594 By default, \fBsudo\fR will use an anonymous connection.
595 .IP "\fB\s-1ROOTUSE_SASL\s0\fR on/true/yes/off/false/no" 4
596 .IX Item "ROOTUSE_SASL on/true/yes/off/false/no"
597 Enable \fB\s-1ROOTUSE_SASL\s0\fR to enable \s-1SASL\s0 authentication when connecting
598 to an \s-1LDAP\s0 server from a privileged process, such as \fBsudo\fR.
599 .IP "\fB\s-1ROOTSASL_AUTH_ID\s0\fR identity" 4
600 .IX Item "ROOTSASL_AUTH_ID identity"
601 The \s-1SASL\s0 user name to use when \fB\s-1ROOTUSE_SASL\s0\fR is enabled.
602 .IP "\fB\s-1SASL_SECPROPS\s0\fR none/properties" 4
603 .IX Item "SASL_SECPROPS none/properties"
604 \&\s-1SASL\s0 security properties or \fInone\fR for no properties. See the
605 \&\s-1SASL\s0 programmer's manual for details.
606 .IP "\fB\s-1KRB5_CCNAME\s0\fR file name" 4
607 .IX Item "KRB5_CCNAME file name"
608 The path to the Kerberos 5 credential cache to use when authenticating
609 with the remote server.
610 .IP "\fB\s-1DEREF\s0\fR never/searching/finding/always" 4
611 .IX Item "DEREF never/searching/finding/always"
612 How alias dereferencing is to be performed when searching. See the
613 \&\fIldap.conf\fR\|(@mansectform@) manual for a full description of this option.
615 See the \f(CW\*(C`ldap.conf\*(C'\fR entry in the \s-1EXAMPLES\s0 section.
616 .SS "Configuring nsswitch.conf"
617 .IX Subsection "Configuring nsswitch.conf"
618 Unless it is disabled at build time, \fBsudo\fR consults the Name
619 Service Switch file, \fI@nsswitch_conf@\fR, to specify the \fIsudoers\fR
620 search order. Sudo looks for a line beginning with \f(CW\*(C`sudoers\*(C'\fR: and
621 uses this to determine the search order. Note that \fBsudo\fR does
622 not stop searching after the first match and later matches take
623 precedence over earlier ones.
625 The following sources are recognized:
628 \& files read sudoers from F<@sysconfdir@/sudoers>
629 \& ldap read sudoers from LDAP
632 In addition, the entry \f(CW\*(C`[NOTFOUND=return]\*(C'\fR will short-circuit the
633 search if the user was not found in the preceding source.
635 To consult \s-1LDAP\s0 first followed by the local sudoers file (if it
639 \& sudoers: ldap files
642 The local \fIsudoers\fR file can be ignored completely by using:
648 If the \fI@nsswitch_conf@\fR file is not present or there is no
649 sudoers line, the following default is assumed:
655 Note that \fI@nsswitch_conf@\fR is supported even when the underlying
656 operating system does not use an nsswitch.conf file.
657 .SS "Configuring netsvc.conf"
658 .IX Subsection "Configuring netsvc.conf"
659 On \s-1AIX\s0 systems, the \fI@netsvc_conf@\fR file is consulted instead of
660 \&\fI@nsswitch_conf@\fR. \fBsudo\fR simply treats \fInetsvc.conf\fR as a
661 variant of \fInsswitch.conf\fR; information in the previous section
662 unrelated to the file format itself still applies.
664 To consult \s-1LDAP\s0 first followed by the local sudoers file (if it
668 \& sudoers = ldap, files
671 The local \fIsudoers\fR file can be ignored completely by using:
677 To treat \s-1LDAP\s0 as authoratative and only use the local sudoers file
678 if the user is not present in \s-1LDAP\s0, use:
681 \& sudoers = ldap = auth, files
684 Note that in the above example, the \f(CW\*(C`auth\*(C'\fR qualfier only affects
685 user lookups; both \s-1LDAP\s0 and \fIsudoers\fR will be queried for \f(CW\*(C`Defaults\*(C'\fR
688 If the \fI@netsvc_conf@\fR file is not present or there is no
689 sudoers line, the following default is assumed:
696 .ie n .IP "\fI@ldap_conf@\fR" 24
697 .el .IP "\fI@ldap_conf@\fR" 24
698 .IX Item "@ldap_conf@"
699 \&\s-1LDAP\s0 configuration file
700 .ie n .IP "\fI@nsswitch_conf@\fR" 24
701 .el .IP "\fI@nsswitch_conf@\fR" 24
702 .IX Item "@nsswitch_conf@"
703 determines sudoers source order
704 .ie n .IP "\fI@netsvc_conf@\fR" 24
705 .el .IP "\fI@netsvc_conf@\fR" 24
706 .IX Item "@netsvc_conf@"
707 determines sudoers source order on \s-1AIX\s0
709 .IX Header "EXAMPLES"
710 .SS "Example ldap.conf"
711 .IX Subsection "Example ldap.conf"
713 \& # Either specify one or more URIs or one or more host:port pairs.
714 \& # If neither is specified sudo will default to localhost, port 389.
717 \& #host ldapserver1 ldapserver2:390
719 \& # Default port if host is specified without one, defaults to 389.
722 \& # URI will override the host and port settings.
723 \& uri ldap://ldapserver
724 \& #uri ldaps://secureldapserver
725 \& #uri ldaps://secureldapserver ldap://ldapserver
727 \& # The amount of time, in seconds, to wait while trying to connect to
731 \& # The amount of time, in seconds, to wait while performing an LDAP query.
734 \& # Must be set or sudo will ignore LDAP; may be specified multiple times.
735 \& sudoers_base ou=SUDOers,dc=example,dc=com
737 \& # verbose sudoers matching from ldap
740 \& # Enable support for time\-based entries in sudoers.
741 \& #sudoers_timed yes
743 \& # optional proxy credentials
744 \& #binddn <who to search as>
745 \& #bindpw <password>
746 \& #rootbinddn <who to search as, uses /etc/ldap.secret for bindpw>
748 \& # LDAP protocol version, defaults to 3
751 \& # Define if you want to use an encrypted LDAP connection.
752 \& # Typically, you must also set the port to 636 (ldaps).
755 \& # Define if you want to use port 389 and switch to
756 \& # encryption before the bind credentials are sent.
757 \& # Only supported by LDAP servers that support the start_tls
758 \& # extension such as OpenLDAP.
761 \& # Additional TLS options follow that allow tweaking of the
762 \& # SSL/TLS connection.
764 \& #tls_checkpeer yes # verify server SSL certificate
765 \& #tls_checkpeer no # ignore server SSL certificate
767 \& # If you enable tls_checkpeer, specify either tls_cacertfile
768 \& # or tls_cacertdir. Only supported when using OpenLDAP.
770 \& #tls_cacertfile /etc/certs/trusted_signers.pem
771 \& #tls_cacertdir /etc/certs
773 \& # For systems that don\*(Aqt have /dev/random
774 \& # use this along with PRNGD or EGD.pl to seed the
775 \& # random number pool to generate cryptographic session keys.
776 \& # Only supported when using OpenLDAP.
778 \& #tls_randfile /etc/egd\-pool
780 \& # You may restrict which ciphers are used. Consult your SSL
781 \& # documentation for which options go here.
782 \& # Only supported when using OpenLDAP.
784 \& #tls_ciphers <cipher\-list>
786 \& # Sudo can provide a client certificate when communicating to
787 \& # the LDAP server.
789 \& # * Enable both lines at the same time.
790 \& # * Do not password protect the key file.
791 \& # * Ensure the keyfile is only readable by root.
794 \& #tls_cert /etc/certs/client_cert.pem
795 \& #tls_key /etc/certs/client_key.pem
797 \& # For SunONE or iPlanet LDAP, tls_cert and tls_key may specify either
798 \& # a directory, in which case the files in the directory must have the
799 \& # default names (e.g. cert8.db and key4.db), or the path to the cert
800 \& # and key files themselves. However, a bug in version 5.0 of the LDAP
801 \& # SDK will prevent specific file names from working. For this reason
802 \& # it is suggested that tls_cert and tls_key be set to a directory,
803 \& # not a file name.
805 \& # The certificate database specified by tls_cert may contain CA certs
806 \& # and/or the client\*(Aqs cert. If the client\*(Aqs cert is included, tls_key
807 \& # should be specified as well.
808 \& # For backward compatibility, "sslpath" may be used in place of tls_cert.
809 \& #tls_cert /var/ldap
810 \& #tls_key /var/ldap
812 \& # If using SASL authentication for LDAP (OpenSSL)
814 \& # sasl_auth_id <SASL user name>
815 \& # rootuse_sasl yes
816 \& # rootsasl_auth_id <SASL user name for root access>
817 \& # sasl_secprops none
818 \& # krb5_ccname /etc/.ldapcache
820 .SS "Sudo schema for OpenLDAP"
821 .IX Subsection "Sudo schema for OpenLDAP"
822 The following schema, in OpenLDAP format, is included with \fBsudo\fR
823 source and binary distributions as \fIschema.OpenLDAP\fR. Simply copy
824 it to the schema directory (e.g. \fI/etc/openldap/schema\fR), add the
825 proper \f(CW\*(C`include\*(C'\fR line in \f(CW\*(C`slapd.conf\*(C'\fR and restart \fBslapd\fR.
828 \& attributetype ( 1.3.6.1.4.1.15953.9.1.1
829 \& NAME \*(AqsudoUser\*(Aq
830 \& DESC \*(AqUser(s) who may run sudo\*(Aq
831 \& EQUALITY caseExactIA5Match
832 \& SUBSTR caseExactIA5SubstringsMatch
833 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
835 \& attributetype ( 1.3.6.1.4.1.15953.9.1.2
836 \& NAME \*(AqsudoHost\*(Aq
837 \& DESC \*(AqHost(s) who may run sudo\*(Aq
838 \& EQUALITY caseExactIA5Match
839 \& SUBSTR caseExactIA5SubstringsMatch
840 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
842 \& attributetype ( 1.3.6.1.4.1.15953.9.1.3
843 \& NAME \*(AqsudoCommand\*(Aq
844 \& DESC \*(AqCommand(s) to be executed by sudo\*(Aq
845 \& EQUALITY caseExactIA5Match
846 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
848 \& attributetype ( 1.3.6.1.4.1.15953.9.1.4
849 \& NAME \*(AqsudoRunAs\*(Aq
850 \& DESC \*(AqUser(s) impersonated by sudo\*(Aq
851 \& EQUALITY caseExactIA5Match
852 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
854 \& attributetype ( 1.3.6.1.4.1.15953.9.1.5
855 \& NAME \*(AqsudoOption\*(Aq
856 \& DESC \*(AqOptions(s) followed by sudo\*(Aq
857 \& EQUALITY caseExactIA5Match
858 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
860 \& attributetype ( 1.3.6.1.4.1.15953.9.1.6
861 \& NAME \*(AqsudoRunAsUser\*(Aq
862 \& DESC \*(AqUser(s) impersonated by sudo\*(Aq
863 \& EQUALITY caseExactIA5Match
864 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
866 \& attributetype ( 1.3.6.1.4.1.15953.9.1.7
867 \& NAME \*(AqsudoRunAsGroup\*(Aq
868 \& DESC \*(AqGroup(s) impersonated by sudo\*(Aq
869 \& EQUALITY caseExactIA5Match
870 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
872 \& attributetype ( 1.3.6.1.4.1.15953.9.1.8
873 \& NAME \*(AqsudoNotBefore\*(Aq
874 \& DESC \*(AqStart of time interval for which the entry is valid\*(Aq
875 \& EQUALITY generalizedTimeMatch
876 \& ORDERING generalizedTimeOrderingMatch
877 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
879 \& attributetype ( 1.3.6.1.4.1.15953.9.1.9
880 \& NAME \*(AqsudoNotAfter\*(Aq
881 \& DESC \*(AqEnd of time interval for which the entry is valid\*(Aq
882 \& EQUALITY generalizedTimeMatch
883 \& ORDERING generalizedTimeOrderingMatch
884 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
886 \& attributeTypes ( 1.3.6.1.4.1.15953.9.1.10
887 \& NAME \*(AqsudoOrder\*(Aq
888 \& DESC \*(Aqan integer to order the sudoRole entries\*(Aq
889 \& EQUALITY integerMatch
890 \& ORDERING integerOrderingMatch
891 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
893 \& objectclass ( 1.3.6.1.4.1.15953.9.2.1 NAME \*(AqsudoRole\*(Aq SUP top STRUCTURAL
894 \& DESC \*(AqSudoer Entries\*(Aq
896 \& MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $
897 \& sudoRunAsGroup $ sudoOption $ sudoNotBefore $ sudoNotAfter $
898 \& sudoOrder $ description )
902 .IX Header "SEE ALSO"
903 \&\fIldap.conf\fR\|(@mansectform@), \fIsudoers\fR\|(@mansectform@)
906 Note that there are differences in the way that LDAP-based \fIsudoers\fR
907 is parsed compared to file-based \fIsudoers\fR. See the \*(L"Differences
908 between \s-1LDAP\s0 and non-LDAP sudoers\*(R" section for more information.
911 If you feel you have found a bug in \fBsudo\fR, please submit a bug report
912 at http://www.sudo.ws/sudo/bugs/
915 Limited free support is available via the sudo-users mailing list,
916 see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
919 .IX Header "DISCLAIMER"
920 \&\fBsudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
921 including, but not limited to, the implied warranties of merchantability
922 and fitness for a particular purpose are disclaimed. See the \s-1LICENSE\s0
923 file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
924 for complete details.
projects / debian / sudo / blob