Sudo Command Alias option equivalent in OpenLDAP

Question

I have an OpenLDAP installation that manages Sudo as well. Everytime I create a sudoers role, I have to list the commands that that sudoers role can run. This leads to a lot of repetition.

Is there a way to group linux commands in a Netgroup sort of way and expand that Netgroup in LDAP sudoers role SudoCommand field? e.g: Create a Netgroup (or something else) called “view” with members /bin/ls, /usr/bin/less, /usr/bin/tail and in the SudoCommand field just enter +view.

This would be beneficial when the same commands need to be granted to various SudoRoles for different directories/files?

Answer 1

Right now, this doesn't exist in the current sudoers.schema definition, and the sudo-ldap software itself probably isn't capable of doing lookups for it. You have to list each command in the command definition.

But if you have your commands in a common directory, you can use some regex to refer to it: sudoCommand = /usr/lib/nagios/plugins/*

That's how I do it.