I've been looking for instructions for adding sudo managment to openldap, but all of them that I've found involve altering ldap.conf. The more recent version of slapd uses a directory-file based database that you're not supposed to touch directly.

Is there a guide somewhere for configuring sudo rights on OpenLDAP 2.4.x on CentOS 7?


As a matter of fact, there is: openldap-sudoers-schema.ldif

Main LDAP Sudoers documentation

There are two main ways to do it, either by creating the ldapSUDOER.schema via ldif files, or by creating posixgroups that are granted sudo privileges on a per-host basis. You can mix and match these, but choosing the ldapSUDOER method has the least overhead. You won't have to configure individual host servers by altering their /etc/sudoers file, and can manage it all from your LDAP server instead which is a bit more convenient.

It's also more secure if you have a lot of change-overs, as it's easy to forget changes you've made on a per-host basis. Leftovers like that can leave little gaps in your security over time.

Regardless of whether you use the dedicated sudoers schema or go with the posix route, you'll need to make some PAM & SSSD/NSCD configuration changes depending on how you've got your authentication set up through LDAP.

RedHat also provides a guide that should be nearly identical to CentOS. I actually used this guide for my own OpenLDAP implementation on Debian, and it was still very useful for the sssd and pam configuration components that will be necessary.

I want to advise caution on your part while messing with the PAM configurations, as any changes could break authentication on the system. Make sure you have a local session open at all times on the server while you are making changes and test authentication thoroughly before closing your sessions. A system backup before you get started is also strongly advised so that you have a fallback if you need it.

-- Cheers!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.