1

I have my Linux machine connected to AD but I am unable to get sudo privileges. I can sign on using AD credentials, but sudo doesn't work.

I have looked at everything I can find and everyone says to add the following to the sudoers file:

%MYDOMAIN\mygroup ALL=(ALL)ALL

When I do this and try to sudo it responds:

myusername is not in the suoders file. This incident will be reported.

Might the problem be that the AD domain/group is not listed in the group or passwd file? If so, how can I add it?

2
  • If you do "getent group MYDOMAIN\mygroup" does it give you members? How are you "connected" to AD, winbind? Put what ever group that your user shows up if you getent yourself. Jul 10, 2015 at 20:53
  • I was able to get it to work, but only by running "id" which responded with my group, which I then put into the Sudoers file. A step in the right direction, but it only work with my primary group as listed in the Unix Attribute in Active Directory. I also need it to work with all groups that it is a member of Jul 10, 2015 at 21:21

1 Answer 1

3

https://unix.stackexchange.com/questions/150476/allow-ad-groups-to-sudo may help:

winbind and sssd import the AD groups in an equivalent manner to NIS netgroups. So your group definitions in the /etc/sudoers file need to start with + and not %. Furthermore, names containing spaces should either be double-quoted, or each space specified as \x20.

%sudo              ALL = (ALL) ALL
+"domain users"    ALL = (ALL) ALL
+domain\x20admins  ALL = (ALL) NOPASSWD: ALL

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.