7

I have active directory sign in working on an Ubuntu 12.04 box. When the user signs in, I have a script that runs that needs sudo permission (since it modifies the samba config file). How would I specify this in my sudoers file?

The active directory user is a part of a group called domain users. I see domain users when I issue groups as the active directory user.

I've tried:

%domain+users ALL=NOPASSWD: /etc/userScripts/createSambaShare.php

This still asks me for a password and then tells me that the user is not in the sudoers file.

Is there a log I can check to see what it's doing when it asks the active directory user for their password?

2 Answers 2

4
+50

It looks like you are using a plus sign in lieu of the space in Domain Users. I don't see any reason why that would work.

Instead, escape the space with a backslash:

 %Domain\ Users ALL=NOPASSWD: /etc/userScripts/createSambaShare.php

If that doesn't work, try using an alias:

 User_Alias DomainUsers=%Domain\ Users
 DomainUsers ALL=NOPASSWD: /etc/userScripts/createSambaShare.php

Also, keep in mind that pretty much everything in Linux is case-sensitive, including user and group names. Is the group really showing up as domain users, or is it showing up as Domain Users? It has to match.

2
  • It is listed as domain users and I guess I thought that was the reason for winbind separator = + in my Samba config. Testing now.
    – nwalke
    Nov 2, 2012 at 18:48
  • 1
    backslash does the trick!
    – nwalke
    Nov 2, 2012 at 18:49
3

Why don't you just set the UNIX group in /etc/sudoers and then make sure everybody is added to that group in AD?

9
  • You mean do something like %Programmers ALL=NOPASSWD: /usr/local/bin/createSambaShare.php ?
    – nwalke
    Oct 8, 2012 at 18:26
  • That seems reasonable enough. Oct 8, 2012 at 18:28
  • I did that. My AD user is part of the "Programmers" group in active directory. Looks like my company has it set up so that the AD Domain Services Folder for the group is Domain.com/Staff/Security Groups, does my group in linux then become %DOMAIN.COM/Staff/Security+Groups/Programmers ?
    – nwalke
    Oct 8, 2012 at 19:17
  • You set up the group in UNIX Attributes, right? Oct 8, 2012 at 21:51
  • I would assume not. I asked our sys admin about the unix tab for each user and he said he didn't see a unix tab, so I'll refer him to your link on my other question.
    – nwalke
    Oct 8, 2012 at 21:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .