1 .\" Copyright (c) 2003-2009
2 .\" Todd C. Miller <Todd.Miller@courtesan.com>
4 .\" Permission to use, copy, modify, and distribute this software for any
5 .\" purpose with or without fee is hereby granted, provided that the above
6 .\" copyright notice and this permission notice appear in all copies.
8 .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
17 .\" $Sudo: sudoers.ldap.man.in,v 1.13 2009/06/11 20:29:12 millert Exp $
18 .\" Automatically generated by Pod::Man 2.16 (Pod::Simple 3.05)
20 .\" Standard preamble:
21 .\" ========================================================================
22 .de Sh \" Subsection heading
30 .de Sp \" Vertical space (when we can't use .PP)
34 .de Vb \" Begin verbatim text
39 .de Ve \" End verbatim text
43 .\" Set up some character translations and predefined strings. \*(-- will
44 .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
45 .\" double quote, and \*(R" will give a right double quote. \*(C+ will
46 .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
47 .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
48 .\" nothing in troff, for use with C<>.
50 .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
54 . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
55 . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
68 .\" Escape single quotes in literal strings from groff's Unicode transform.
72 .\" If the F register is turned on, we'll generate index entries on stderr for
73 .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
74 .\" entries marked with X<> in POD. Of course, you'll have to process the
75 .\" output yourself in some meaningful fashion.
78 . tm Index:\\$1\t\\n%\t"\\$2"
88 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
89 .\" Fear. Run. Save yourself. No user-serviceable parts.
90 . \" fudge factors for nroff and troff
99 . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
105 . \" simple accents for nroff and troff
115 . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
116 . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
117 . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
118 . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
119 . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
120 . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
122 . \" troff and (daisy-wheel) nroff accents
123 .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
124 .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
125 .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
126 .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
127 .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
128 .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
129 .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
130 .ds ae a\h'-(\w'a'u*4/10)'e
131 .ds Ae A\h'-(\w'A'u*4/10)'E
132 . \" corrections for vroff
133 .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
134 .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
135 . \" for low resolution devices (crt and lpr)
136 .if \n(.H>23 .if \n(.V>19 \
149 .\" ========================================================================
151 .IX Title "SUDOERS.LDAP @mansectform@"
152 .TH SUDOERS.LDAP @mansectform@ "June 11, 2009" "1.7.2p1" "MAINTENANCE COMMANDS"
153 .\" For nroff, turn off justification. Always turn off hyphenation; it makes
154 .\" way too many mistakes in technical documents.
158 sudoers.ldap \- sudo LDAP configuration
160 .IX Header "DESCRIPTION"
161 In addition to the standard \fIsudoers\fR file, \fBsudo\fR may be configured
162 via \s-1LAP\s0. This can be especially useful for synchronizing \fIsudoers\fR
163 in a large, distributed environment.
165 Using \s-1LDAP\s0 for \fIsudoers\fR has several benefits:
167 \&\fBsudo\fR no longer needs to read \fIsudoers\fR in its entirety. When
168 \&\s-1LDAP\s0 is used, there are only two or three \s-1LDAP\s0 queries per invocation.
169 This makes it especially fast and particularly usable in \s-1LDAP\s0
172 \&\fBsudo\fR no longer exits if there is a typo in \fIsudoers\fR.
173 It is not possible to load \s-1LDAP\s0 data into the server that does
174 not conform to the sudoers schema, so proper syntax is guaranteed.
175 It is still possible to have typos in a user or host name, but
176 this will not prevent \fBsudo\fR from running.
178 It is possible to specify per-entry options that override the global
179 default options. \fI@sysconfdir@/sudoers\fR only supports default options and
180 limited options associated with user/host/commands/aliases. The
181 syntax is complicated and can be difficult for users to understand.
182 Placing the options directly in the entry is more natural.
184 The \fBvisudo\fR program is no longer needed. \fBvisudo\fR provides
185 locking and syntax checking of the \fI@sysconfdir@/sudoers\fR file.
186 Since \s-1LDAP\s0 updates are atomic, locking is no longer necessary.
187 Because syntax is checked when the data is inserted into \s-1LDAP\s0, there
188 is no need for a specialized tool to check syntax.
190 Another major difference between \s-1LDAP\s0 and file-based \fIsudoers\fR
191 is that in \s-1LDAP\s0, \fBsudo\fR\-specific Aliases are not supported.
193 For the most part, there is really no need for \fBsudo\fR\-specific
194 Aliases. Unix groups or user netgroups can be used in place of
195 User_Aliases and RunasAliases. Host netgroups can be used in place
196 of HostAliases. Since Unix groups and netgroups can also be stored
197 in \s-1LDAP\s0 there is no real need for \fBsudo\fR\-specific aliases.
199 Cmnd_Aliases are not really required either since it is possible
200 to have multiple users listed in a sudoRole. Instead of defining
201 a Cmnd_Alias that is referenced by multiple users, one can create
202 a sudoRole that contains the commands and assign multiple users
204 .Sh "SUDOers \s-1LDAP\s0 container"
205 .IX Subsection "SUDOers LDAP container"
206 The \fIsudoers\fR configuration is contained in the \f(CW\*(C`ou=SUDOers\*(C'\fR \s-1LDAP\s0
209 Sudo first looks for the \f(CW\*(C`cn=default\*(C'\fR entry in the SUDOers container.
210 If found, the multi-valued \f(CW\*(C`sudoOption\*(C'\fR attribute is parsed in the
211 same manner as a global \f(CW\*(C`Defaults\*(C'\fR line in \fI@sysconfdir@/sudoers\fR. In
212 the following example, the \f(CW\*(C`SSH_AUTH_SOCK\*(C'\fR variable will be preserved
213 in the environment for all users.
216 \& dn: cn=defaults,ou=SUDOers,dc=example,dc=com
218 \& objectClass: sudoRole
220 \& description: Default sudoOption\*(Aqs go here
221 \& sudoOption: env_keep+=SSH_AUTH_SOCK
224 The equivalent of a sudoer in \s-1LDAP\s0 is a \f(CW\*(C`sudoRole\*(C'\fR. It consists of
225 the following components:
226 .IP "\fBsudoUser\fR" 4
228 A user name, uid (prefixed with \f(CW\*(Aq#\*(Aq\fR), Unix group (prefixed with
229 a \f(CW\*(Aq%\*(Aq\fR) or user netgroup (prefixed with a \f(CW\*(Aq+\*(Aq\fR).
230 .IP "\fBsudoHost\fR" 4
232 A host name, \s-1IP\s0 address, \s-1IP\s0 network, or host netgroup (prefixed
233 with a \f(CW\*(Aq+\*(Aq\fR).
234 The special value \f(CW\*(C`ALL\*(C'\fR will match any host.
235 .IP "\fBsudoCommand\fR" 4
236 .IX Item "sudoCommand"
237 A Unix command with optional command line arguments, potentially
238 including globbing characters (aka wild cards).
239 The special value \f(CW\*(C`ALL\*(C'\fR will match any command.
240 If a command is prefixed with an exclamation point \f(CW\*(Aq!\*(Aq\fR, the
241 user will be prohibited from running that command.
242 .IP "\fBsudoOption\fR" 4
243 .IX Item "sudoOption"
244 Identical in function to the global options described above, but
245 specific to the \f(CW\*(C`sudoRole\*(C'\fR in which it resides.
246 .IP "\fBsudoRunAsUser\fR" 4
247 .IX Item "sudoRunAsUser"
248 A user name or uid (prefixed with \f(CW\*(Aq#\*(Aq\fR) that commands may be run
249 as or a Unix group (prefixed with a \f(CW\*(Aq%\*(Aq\fR) or user netgroup (prefixed
250 with a \f(CW\*(Aq+\*(Aq\fR) that contains a list of users that commands may be
252 The special value \f(CW\*(C`ALL\*(C'\fR will match any user.
253 .IP "\fBsudoRunAsGroup\fR" 4
254 .IX Item "sudoRunAsGroup"
255 A Unix group or gid (prefixed with \f(CW\*(Aq#\*(Aq\fR) that commands may be run as.
256 The special value \f(CW\*(C`ALL\*(C'\fR will match any group.
258 Each component listed above should contain a single value, but there
259 may be multiple instances of each component type. A sudoRole must
260 contain at least one \f(CW\*(C`sudoUser\*(C'\fR, \f(CW\*(C`sudoHost\*(C'\fR and \f(CW\*(C`sudoCommand\*(C'\fR.
262 The following example allows users in group wheel to run any command
263 on any host via \fBsudo\fR:
266 \& dn: cn=%wheel,ou=SUDOers,dc=example,dc=com
268 \& objectClass: sudoRole
274 .Sh "Anatomy of \s-1LDAP\s0 sudoers lookup"
275 .IX Subsection "Anatomy of LDAP sudoers lookup"
276 When looking up a sudoer using \s-1LDAP\s0 there are only two or three
277 \&\s-1LDAP\s0 queries per invocation. The first query is to parse the global
278 options. The second is to match against the user's name and the
279 groups that the user belongs to. (The special \s-1ALL\s0 tag is matched
280 in this query too.) If no match is returned for the user's name
281 and groups, a third query returns all entries containing user
282 netgroups and checks to see if the user belongs to any of them.
283 .Sh "Differences between \s-1LDAP\s0 and non-LDAP sudoers"
284 .IX Subsection "Differences between LDAP and non-LDAP sudoers"
285 There are some subtle differences in the way sudoers is handled
286 once in \s-1LDAP\s0. Probably the biggest is that according to the \s-1RFC\s0,
287 \&\s-1LDAP\s0 ordering is arbitrary and you cannot expect that Attributes
288 and Entries are returned in any specific order. If there are
289 conflicting command rules on an entry, the negative takes precedence.
290 This is called paranoid behavior (not necessarily the most specific
297 \& # Allow all commands except shell
298 \& johnny ALL=(root) ALL,!/bin/sh
299 \& # Always allows all commands because ALL is matched last
300 \& puddles ALL=(root) !/bin/sh,ALL
302 \& # LDAP equivalent of johnny
303 \& # Allows all commands except shell
304 \& dn: cn=role1,ou=Sudoers,dc=my\-domain,dc=com
305 \& objectClass: sudoRole
311 \& sudoCommand: !/bin/sh
313 \& # LDAP equivalent of puddles
314 \& # Notice that even though ALL comes last, it still behaves like
315 \& # role1 since the LDAP code assumes the more paranoid configuration
316 \& dn: cn=role2,ou=Sudoers,dc=my\-domain,dc=com
317 \& objectClass: sudoRole
322 \& sudoCommand: !/bin/sh
326 Another difference is that negations on the Host, User or Runas are
327 currently ignorred. For example, the following attributes do not
328 behave the way one might expect.
331 \& # does not match all but joe
332 \& # rather, does not match anyone
335 \& # does not match all but joe
336 \& # rather, matches everyone including Joe
340 \& # does not match all but web01
341 \& # rather, matches all hosts including web01
346 .IX Subsection "Sudoers Schema"
347 In order to use \fBsudo\fR's \s-1LDAP\s0 support, the \fBsudo\fR schema must be
348 installed on your \s-1LDAP\s0 server. In addition, be sure to index the
349 \&'sudoUser' attribute.
351 Three versions of the schema: one for OpenLDAP servers (\fIschema.OpenLDAP\fR),
352 one for Netscape-derived servers (\fIschema.iPlanet\fR), and one for
353 Microsoft Active Directory (\fIschema.ActiveDirectory\fR) may
354 be found in the \fBsudo\fR distribution.
356 The schema for \fBsudo\fR in OpenLDAP form is included in the \s-1EXAMPLES\s0
358 .Sh "Configuring ldap.conf"
359 .IX Subsection "Configuring ldap.conf"
360 Sudo reads the \fI@ldap_conf@\fR file for LDAP-specific configuration.
361 Typically, this file is shared amongst different LDAP-aware clients.
362 As such, most of the settings are not \fBsudo\fR\-specific. Note that
363 \&\fBsudo\fR parses \fI@ldap_conf@\fR itself and may support options
364 that differ from those described in the \fIldap.conf\fR\|(@mansectform@) manual.
366 Also note that on systems using the OpenLDAP libraries, default
367 values specified in \fI/etc/openldap/ldap.conf\fR or the user's
368 \&\fI.ldaprc\fR files are not used.
370 Only those options explicitly listed in \fI@ldap_conf@\fR that are
371 supported by \fBsudo\fR are honored. Configuration options are listed
372 below in upper case but are parsed in a case-independent manner.
373 .IP "\fB\s-1URI\s0\fR ldap[s]://[hostname[:port]] ..." 4
374 .IX Item "URI ldap[s]://[hostname[:port]] ..."
375 Specifies a whitespace-delimited list of one or more URIs describing
376 the \s-1LDAP\s0 server(s) to connect to. The \fIprotocol\fR may be either \fBldap\fR
377 or \fBldaps\fR, the latter being for servers that support \s-1TLS\s0 (\s-1SSL\s0)
378 encryption. If no \fIport\fR is specified, the default is port 389 for
379 \&\f(CW\*(C`ldap://\*(C'\fR or port 636 for \f(CW\*(C`ldaps://\*(C'\fR. If no \fIhostname\fR is specified,
380 \&\fBsudo\fR will connect to \fBlocalhost\fR. Only systems using the OpenSSL
381 libraries support the mixing of \f(CW\*(C`ldap://\*(C'\fR and \f(CW\*(C`ldaps://\*(C'\fR URIs.
382 The Netscape-derived libraries used on most commercial versions of
383 Unix are only capable of supporting one or the other.
384 .IP "\fB\s-1HOST\s0\fR name[:port] ..." 4
385 .IX Item "HOST name[:port] ..."
386 If no \fB\s-1URI\s0\fR is specified, the \fB\s-1HOST\s0\fR parameter specifies a
387 whitespace-delimited list of \s-1LDAP\s0 servers to connect to. Each host
388 may include an optional \fIport\fR separated by a colon (':'). The
389 \&\fB\s-1HOST\s0\fR parameter is deprecated in favor of the \fB\s-1URI\s0\fR specification
390 and is included for backwards compatibility.
391 .IP "\fB\s-1PORT\s0\fR port_number" 4
392 .IX Item "PORT port_number"
393 If no \fB\s-1URI\s0\fR is specified, the \fB\s-1PORT\s0\fR parameter specifies the
394 default port to connect to on the \s-1LDAP\s0 server if a \fB\s-1HOST\s0\fR parameter
395 does not specify the port itself. If no \fB\s-1PORT\s0\fR parameter is used,
396 the default is port 389 for \s-1LDAP\s0 and port 636 for \s-1LDAP\s0 over \s-1TLS\s0
397 (\s-1SSL\s0). The \fB\s-1PORT\s0\fR parameter is deprecated in favor of the \fB\s-1URI\s0\fR
398 specification and is included for backwards compatibility.
399 .IP "\fB\s-1BIND_TIMELIMIT\s0\fR seconds" 4
400 .IX Item "BIND_TIMELIMIT seconds"
401 The \fB\s-1BIND_TIMELIMIT\s0\fR parameter specifies the amount of time, in seconds,
402 to wait while trying to connect to an \s-1LDAP\s0 server. If multiple \fB\s-1URI\s0\fRs or
403 \&\fB\s-1HOST\s0\fRs are specified, this is the amount of time to wait before trying
404 the next one in the list.
405 .IP "\fB\s-1TIMELIMIT\s0\fR seconds" 4
406 .IX Item "TIMELIMIT seconds"
407 The \fB\s-1TIMELIMIT\s0\fR parameter specifies the amount of time, in seconds,
408 to wait for a response to an \s-1LDAP\s0 query.
409 .IP "\fB\s-1SUDOERS_BASE\s0\fR base" 4
410 .IX Item "SUDOERS_BASE base"
411 The base \s-1DN\s0 to use when performing \fBsudo\fR \s-1LDAP\s0 queries. Typically
412 this is of the form \f(CW\*(C`ou=SUDOers,dc=example,dc=com\*(C'\fR for the domain
413 \&\f(CW\*(C`example.com\*(C'\fR.
414 .IP "\fB\s-1SUDOERS_DEBUG\s0\fR debug_level" 4
415 .IX Item "SUDOERS_DEBUG debug_level"
416 This sets the debug level for \fBsudo\fR \s-1LDAP\s0 queries. Debugging
417 information is printed to the standard error. A value of 1 results
418 in a moderate amount of debugging information. A value of 2 shows
419 the results of the matches themselves. This parameter should not
420 be set in a production environment as the extra information is
421 likely to confuse users.
422 .IP "\fB\s-1BINDDN\s0\fR \s-1DN\s0" 4
424 The \fB\s-1BINDDN\s0\fR parameter specifies the identity, in the form of a
425 Distinguished Name (\s-1DN\s0), to use when performing \s-1LDAP\s0 operations.
426 If not specified, \s-1LDAP\s0 operations are performed with an anonymous
427 identity. By default, most \s-1LDAP\s0 servers will allow anonymous access.
428 .IP "\fB\s-1BINDPW\s0\fR secret" 4
429 .IX Item "BINDPW secret"
430 The \fB\s-1BINDPW\s0\fR parameter specifies the password to use when performing
431 \&\s-1LDAP\s0 operations. This is typically used in conjunction with the
432 \&\fB\s-1BINDDN\s0\fR parameter.
433 .IP "\fB\s-1ROOTBINDDN\s0\fR \s-1DN\s0" 4
434 .IX Item "ROOTBINDDN DN"
435 The \fB\s-1ROOTBINDDN\s0\fR parameter specifies the identity, in the form of
436 a Distinguished Name (\s-1DN\s0), to use when performing privileged \s-1LDAP\s0
437 operations, such as \fIsudoers\fR queries. The password corresponding
438 to the identity should be stored in \fI@ldap_secret@\fR.
439 If not specified, the \fB\s-1BINDDN\s0\fR identity is used (if any).
440 .IP "\fB\s-1LDAP_VERSION\s0\fR number" 4
441 .IX Item "LDAP_VERSION number"
442 The version of the \s-1LDAP\s0 protocol to use when connecting to the server.
443 The default value is protocol version 3.
444 .IP "\fB\s-1SSL\s0\fR on/true/yes/off/false/no" 4
445 .IX Item "SSL on/true/yes/off/false/no"
446 If the \fB\s-1SSL\s0\fR parameter is set to \f(CW\*(C`on\*(C'\fR, \f(CW\*(C`true\*(C'\fR or \f(CW\*(C`yes\*(C'\fR, \s-1TLS\s0
447 (\s-1SSL\s0) encryption is always used when communicating with the \s-1LDAP\s0
448 server. Typically, this involves connecting to the server on port
450 .IP "\fB\s-1SSL\s0\fR start_tls" 4
451 .IX Item "SSL start_tls"
452 If the \fB\s-1SSL\s0\fR parameter is set to \f(CW\*(C`start_tls\*(C'\fR, the \s-1LDAP\s0 server
453 connection is initiated normally and \s-1TLS\s0 encryption is begun before
454 the bind credentials are sent. This has the advantage of not
455 requiring a dedicated port for encrypted communications. This
456 parameter is only supported by \s-1LDAP\s0 servers that honor the \f(CW\*(C`start_tls\*(C'\fR
457 extension, such as the OpenLDAP server.
458 .IP "\fB\s-1TLS_CHECKPEER\s0\fR on/true/yes/off/false/no" 4
459 .IX Item "TLS_CHECKPEER on/true/yes/off/false/no"
460 If enabled, \fB\s-1TLS_CHECKPEER\s0\fR will cause the \s-1LDAP\s0 server's \s-1TLS\s0
461 certificated to be verified. If the server's \s-1TLS\s0 certificate cannot
462 be verified (usually because it is signed by an unknown certificate
463 authority), \fBsudo\fR will be unable to connect to it. If \fB\s-1TLS_CHECKPEER\s0\fR
464 is disabled, no check is made.
465 .IP "\fB\s-1TLS_CACERTFILE\s0\fR file name" 4
466 .IX Item "TLS_CACERTFILE file name"
467 The path to a certificate authority bundle which contains the certificates
468 for all the Certificate Authorities the client knows to be valid,
469 e.g. \fI/etc/ssl/ca\-bundle.pem\fR.
470 This option is only supported by the OpenLDAP libraries.
471 .IP "\fB\s-1TLS_CACERTDIR\s0\fR directory" 4
472 .IX Item "TLS_CACERTDIR directory"
473 Similar to \fB\s-1TLS_CACERTFILE\s0\fR but instead of a file, it is a
474 directory containing individual Certificate Authority certificates,
475 e.g. \fI/etc/ssl/certs\fR.
476 The directory specified by \fB\s-1TLS_CACERTDIR\s0\fR is checked after
477 \&\fB\s-1TLS_CACERTFILE\s0\fR.
478 This option is only supported by the OpenLDAP libraries.
479 .IP "\fB\s-1TLS_CERT\s0\fR file name" 4
480 .IX Item "TLS_CERT file name"
481 The path to a file containing the client certificate which can
482 be used to authenticate the client to the \s-1LDAP\s0 server.
483 The certificate type depends on the \s-1LDAP\s0 libraries used.
486 \f(CW\*(C`tls_cert /etc/ssl/client_cert.pem\*(C'\fR
489 \f(CW\*(C`tls_cert /var/ldap/cert7.db\*(C'\fR
491 When using Netscape-derived libraries, this file may also contain
492 Certificate Authority certificates.
493 .IP "\fB\s-1TLS_KEY\s0\fR file name" 4
494 .IX Item "TLS_KEY file name"
495 The path to a file containing the private key which matches the
496 certificate specified by \fB\s-1TLS_CERT\s0\fR. The private key must not be
497 password-protected. The key type depends on the \s-1LDAP\s0 libraries
501 \f(CW\*(C`tls_key /etc/ssl/client_key.pem\*(C'\fR
504 \f(CW\*(C`tls_key /var/ldap/key3.db\*(C'\fR
505 .IP "\fB\s-1TLS_RANDFILE\s0\fR file name" 4
506 .IX Item "TLS_RANDFILE file name"
507 The \fB\s-1TLS_RANDFILE\s0\fR parameter specifies the path to an entropy
508 source for systems that lack a random device. It is generally used
509 in conjunction with \fIprngd\fR or \fIegd\fR.
510 This option is only supported by the OpenLDAP libraries.
511 .IP "\fB\s-1TLS_CIPHERS\s0\fR cipher list" 4
512 .IX Item "TLS_CIPHERS cipher list"
513 The \fB\s-1TLS_CIPHERS\s0\fR parameter allows the administer to restrict
514 which encryption algorithms may be used for \s-1TLS\s0 (\s-1SSL\s0) connections.
515 See the OpenSSL manual for a list of valid ciphers.
516 This option is only supported by the OpenLDAP libraries.
517 .IP "\fB\s-1USE_SASL\s0\fR on/true/yes/off/false/no" 4
518 .IX Item "USE_SASL on/true/yes/off/false/no"
519 Enable \fB\s-1USE_SASL\s0\fR for \s-1LDAP\s0 servers that support \s-1SASL\s0 authentication.
520 .IP "\fB\s-1SASL_AUTH_ID\s0\fR identity" 4
521 .IX Item "SASL_AUTH_ID identity"
522 The \s-1SASL\s0 user name to use when connecting to the \s-1LDAP\s0 server.
523 By default, \fBsudo\fR will use an anonymous connection.
524 .IP "\fB\s-1ROOTUSE_SASL\s0\fR on/true/yes/off/false/no" 4
525 .IX Item "ROOTUSE_SASL on/true/yes/off/false/no"
526 Enable \fB\s-1ROOTUSE_SASL\s0\fR to enable \s-1SASL\s0 authentication when connecting
527 to an \s-1LDAP\s0 server from a privileged process, such as \fBsudo\fR.
528 .IP "\fB\s-1ROOTSASL_AUTH_ID\s0\fR identity" 4
529 .IX Item "ROOTSASL_AUTH_ID identity"
530 The \s-1SASL\s0 user name to use when \fB\s-1ROOTUSE_SASL\s0\fR is enabled.
531 .IP "\fB\s-1SASL_SECPROPS\s0\fR none/properties" 4
532 .IX Item "SASL_SECPROPS none/properties"
533 \&\s-1SASL\s0 security properties or \fInone\fR for no properties. See the
534 \&\s-1SASL\s0 programmer's manual for details.
535 .IP "\fB\s-1KRB5_CCNAME\s0\fR file name" 4
536 .IX Item "KRB5_CCNAME file name"
537 The path to the Kerberos 5 credential cache to use when authenticating
538 with the remote server.
540 See the \f(CW\*(C`ldap.conf\*(C'\fR entry in the \s-1EXAMPLES\s0 section.
541 .Sh "Configuring nsswitch.conf"
542 .IX Subsection "Configuring nsswitch.conf"
543 Unless it is disabled at build time, \fBsudo\fR consults the Name
544 Service Switch file, \fI@nsswitch_conf@\fR, to specify the \fIsudoers\fR
545 search order. Sudo looks for a line beginning with \f(CW\*(C`sudoers\*(C'\fR: and
546 uses this to determine the search order. Note that \fBsudo\fR does
547 not stop searching after the first match and later matches take
548 precedence over earlier ones.
550 The following sources are recognized:
553 \& files read sudoers from F<@sysconfdir@/sudoers>
554 \& ldap read sudoers from LDAP
557 In addition, the entry \f(CW\*(C`[NOTFOUND=return]\*(C'\fR will short-circuit the
558 search if the user was not found in the preceding source.
560 To consult \s-1LDAP\s0 first followed by the local sudoers file (if it
564 \& sudoers: ldap files
567 The local \fIsudoers\fR file can be ignored completely by using:
573 If the \fI@nsswitch_conf@\fR file is not present or there is no
574 sudoers line, the following default is assumed:
580 Note that \fI@nsswitch_conf@\fR is supported even when the underlying
581 operating system does not use an nsswitch.conf file.
582 .Sh "Configuring netsvc.conf"
583 .IX Subsection "Configuring netsvc.conf"
584 On \s-1AIX\s0 systems, the \fI@netsvc_conf@\fR file is consulted instead of
585 \&\fI@nsswitch_conf@\fR. \fBsudo\fR simply treats \fInetsvc.conf\fR as a
586 variant of \fInsswitch.conf\fR; information in the previous section
587 unrelated to the file format itself still applies.
589 To consult \s-1LDAP\s0 first followed by the local sudoers file (if it
593 \& sudoers = ldap, files
596 The local \fIsudoers\fR file can be ignored completely by using:
602 To treat \s-1LDAP\s0 as authoratative and only use the local sudoers file
603 if the user is not present in \s-1LDAP\s0, use:
606 \& sudoers = ldap = auth, files
609 Note that in the above example, the \f(CW\*(C`auth\*(C'\fR qualfier only affects
610 user lookups; both \s-1LDAP\s0 and \fIsudoers\fR will be queried for \f(CW\*(C`Defaults\*(C'\fR
613 If the \fI@netsvc_conf@\fR file is not present or there is no
614 sudoers line, the following default is assumed:
621 .ie n .IP "\fI@ldap_conf@\fR" 24
622 .el .IP "\fI@ldap_conf@\fR" 24
623 .IX Item "@ldap_conf@"
624 \&\s-1LDAP\s0 configuration file
625 .ie n .IP "\fI@nsswitch_conf@\fR" 24
626 .el .IP "\fI@nsswitch_conf@\fR" 24
627 .IX Item "@nsswitch_conf@"
628 determines sudoers source order
629 .ie n .IP "\fI@netsvc_conf@\fR" 24
630 .el .IP "\fI@netsvc_conf@\fR" 24
631 .IX Item "@netsvc_conf@"
632 determines sudoers source order on \s-1AIX\s0
634 .IX Header "EXAMPLES"
635 .Sh "Example ldap.conf"
636 .IX Subsection "Example ldap.conf"
638 \& # Either specify one or more URIs or one or more host:port pairs.
639 \& # If neither is specified sudo will default to localhost, port 389.
642 \& #host ldapserver1 ldapserver2:390
644 \& # Default port if host is specified without one, defaults to 389.
647 \& # URI will override the host and port settings.
648 \& uri ldap://ldapserver
649 \& #uri ldaps://secureldapserver
650 \& #uri ldaps://secureldapserver ldap://ldapserver
652 \& # The amount of time, in seconds, to wait while trying to connect to
656 \& # The amount of time, in seconds, to wait while performing an LDAP query.
659 \& # must be set or sudo will ignore LDAP
660 \& sudoers_base ou=SUDOers,dc=example,dc=com
662 \& # verbose sudoers matching from ldap
665 \& # optional proxy credentials
666 \& #binddn <who to search as>
667 \& #bindpw <password>
668 \& #rootbinddn <who to search as, uses /etc/ldap.secret for bindpw>
670 \& # LDAP protocol version, defaults to 3
673 \& # Define if you want to use an encrypted LDAP connection.
674 \& # Typically, you must also set the port to 636 (ldaps).
677 \& # Define if you want to use port 389 and switch to
678 \& # encryption before the bind credentials are sent.
679 \& # Only supported by LDAP servers that support the start_tls
680 \& # extension such as OpenLDAP.
683 \& # Additional TLS options follow that allow tweaking of the
684 \& # SSL/TLS connection.
686 \& #tls_checkpeer yes # verify server SSL certificate
687 \& #tls_checkpeer no # ignore server SSL certificate
689 \& # If you enable tls_checkpeer, specify either tls_cacertfile
690 \& # or tls_cacertdir. Only supported when using OpenLDAP.
692 \& #tls_cacertfile /etc/certs/trusted_signers.pem
693 \& #tls_cacertdir /etc/certs
695 \& # For systems that don\*(Aqt have /dev/random
696 \& # use this along with PRNGD or EGD.pl to seed the
697 \& # random number pool to generate cryptographic session keys.
698 \& # Only supported when using OpenLDAP.
700 \& #tls_randfile /etc/egd\-pool
702 \& # You may restrict which ciphers are used. Consult your SSL
703 \& # documentation for which options go here.
704 \& # Only supported when using OpenLDAP.
706 \& #tls_ciphers <cipher\-list>
708 \& # Sudo can provide a client certificate when communicating to
709 \& # the LDAP server.
711 \& # * Enable both lines at the same time.
712 \& # * Do not password protect the key file.
713 \& # * Ensure the keyfile is only readable by root.
716 \& #tls_cert /etc/certs/client_cert.pem
717 \& #tls_key /etc/certs/client_key.pem
719 \& # For SunONE or iPlanet LDAP, tls_cert and tls_key may specify either
720 \& # a directory, in which case the files in the directory must have the
721 \& # default names (e.g. cert8.db and key4.db), or the path to the cert
722 \& # and key files themselves. However, a bug in version 5.0 of the LDAP
723 \& # SDK will prevent specific file names from working. For this reason
724 \& # it is suggested that tls_cert and tls_key be set to a directory,
725 \& # not a file name.
727 \& # The certificate database specified by tls_cert may contain CA certs
728 \& # and/or the client\*(Aqs cert. If the client\*(Aqs cert is included, tls_key
729 \& # should be specified as well.
730 \& # For backward compatibility, "sslpath" may be used in place of tls_cert.
731 \& #tls_cert /var/ldap
732 \& #tls_key /var/ldap
734 \& # If using SASL authentication for LDAP (OpenSSL)
736 \& # sasl_auth_id <SASL username>
737 \& # rootuse_sasl yes
738 \& # rootsasl_auth_id <SASL username for root access>
739 \& # sasl_secprops none
740 \& # krb5_ccname /etc/.ldapcache
742 .Sh "Sudo schema for OpenLDAP"
743 .IX Subsection "Sudo schema for OpenLDAP"
744 The following schema is in OpenLDAP format. Simply copy it to the
745 schema directory (e.g. \fI/etc/openldap/schema\fR), add the proper
746 \&\f(CW\*(C`include\*(C'\fR line in \f(CW\*(C`slapd.conf\*(C'\fR and restart \fBslapd\fR.
749 \& attributetype ( 1.3.6.1.4.1.15953.9.1.1
750 \& NAME \*(AqsudoUser\*(Aq
751 \& DESC \*(AqUser(s) who may run sudo\*(Aq
752 \& EQUALITY caseExactIA5Match
753 \& SUBSTR caseExactIA5SubstringsMatch
754 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
756 \& attributetype ( 1.3.6.1.4.1.15953.9.1.2
757 \& NAME \*(AqsudoHost\*(Aq
758 \& DESC \*(AqHost(s) who may run sudo\*(Aq
759 \& EQUALITY caseExactIA5Match
760 \& SUBSTR caseExactIA5SubstringsMatch
761 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
763 \& attributetype ( 1.3.6.1.4.1.15953.9.1.3
764 \& NAME \*(AqsudoCommand\*(Aq
765 \& DESC \*(AqCommand(s) to be executed by sudo\*(Aq
766 \& EQUALITY caseExactIA5Match
767 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
769 \& attributetype ( 1.3.6.1.4.1.15953.9.1.4
770 \& NAME \*(AqsudoRunAs\*(Aq
771 \& DESC \*(AqUser(s) impersonated by sudo\*(Aq
772 \& EQUALITY caseExactIA5Match
773 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
775 \& attributetype ( 1.3.6.1.4.1.15953.9.1.5
776 \& NAME \*(AqsudoOption\*(Aq
777 \& DESC \*(AqOptions(s) followed by sudo\*(Aq
778 \& EQUALITY caseExactIA5Match
779 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
781 \& attributetype ( 1.3.6.1.4.1.15953.9.1.6
782 \& NAME \*(AqsudoRunAsUser\*(Aq
783 \& DESC \*(AqUser(s) impersonated by sudo\*(Aq
784 \& EQUALITY caseExactIA5Match
785 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
787 \& attributetype ( 1.3.6.1.4.1.15953.9.1.7
788 \& NAME \*(AqsudoRunAsGroup\*(Aq
789 \& DESC \*(AqGroup(s) impersonated by sudo\*(Aq
790 \& EQUALITY caseExactIA5Match
791 \& SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
793 \& objectclass ( 1.3.6.1.4.1.15953.9.2.1 NAME \*(AqsudoRole\*(Aq SUP top STRUCTURAL
794 \& DESC \*(AqSudoer Entries\*(Aq
796 \& MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $
797 \& sudoRunAsGroup $ sudoOption $ description )
801 .IX Header "SEE ALSO"
802 \&\fIldap.conf\fR\|(@mansectform@), \fIsudoers\fR\|(5)
805 The way that \fIsudoers\fR is parsed differs between Note that there
806 are differences in the way that LDAP-based \fIsudoers\fR is parsed
807 compared to file-based \fIsudoers\fR. See the \*(L"Differences between
808 \&\s-1LDAP\s0 and non-LDAP sudoers\*(R" section for more information.
811 If you feel you have found a bug in \fBsudo\fR, please submit a bug report
812 at http://www.sudo.ws/sudo/bugs/
815 Limited free support is available via the sudo-users mailing list,
816 see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
819 .IX Header "DISCLAIMER"
820 \&\fBsudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
821 including, but not limited to, the implied warranties of merchantability
822 and fitness for a particular purpose are disclaimed. See the \s-1LICENSE\s0
823 file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
824 for complete details.
projects / debian / sudo / blob