I have an OpenLDAP installation that manages Sudo as well. Everytime I create a sudoers role, I have to list the commands that that sudoers role can run. This leads to a lot of repetition.

Is there a way to group linux commands in a Netgroup sort of way and expand that Netgroup in LDAP sudoers role SudoCommand field? e.g: Create a Netgroup (or something else) called “view” with members /bin/ls, /usr/bin/less, /usr/bin/tail and in the SudoCommand field just enter +view.

This would be beneficial when the same commands need to be granted to various SudoRoles for different directories/files?


Right now, this doesn't exist in the current sudoers.schema definition, and the sudo-ldap software itself probably isn't capable of doing lookups for it. You have to list each command in the command definition.

But if you have your commands in a common directory, you can use some regex to refer to it: sudoCommand = /usr/lib/nagios/plugins/*

That's how I do it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.