Red Hat Training Fees

Configuring sudo

Basic syntax

USER MACHINE = (RUN_AS) COMMANDS

Examples:

%group ALL = (root) /sbin/ifconfig

%wheel ALL=(ALL) ALL

%admins ALL=(ALL) NOPASSWD: ALL

Grant use access to commands in NETWORKING group

joseph ALL=NETWORKING

Use User_Alias to grant access to list of users

User_Alias ADMINS = lex, john

Use Cmnd_Alias to set a list of commands

Cmnd_Alias NETWORKING = /sbin/ruote, /sbin/ifconfig

Aliases are "string of uppercase letters, numbers, and the underscore characters"

Groups are denoted with %group, username, #uid:

# man sudoers Runas_Member ::= '!'* user name | '!'* '#'uid | '!'* '%'group | '!'* +netgroup | '!'* Runas_Alias

Kerberos Authentication:

• Kerberos more secure than LDAP as it doesn't pass passwords over network.

• How it works?:

  • KDC: Key distribution center: Grant tickets

  • KAdmin Server: Used to update passwords.

  • Realm: Set of systems which use the same KDCs.

• Configuring auth:

  • Via GUI: system-config-authentication.

  • Via command-line: authconfig.

  • Question: Which command line tool can be used for configuring Kerberos?

  • Answer: authconfig

  > authconfig --enableldap --ldapserver=instructor.example.com \ --enableldaptls --ldaploadcacert=ftp://instructor.example.com/pub/example-ca.crt \ --ldapbasedn="dc=example,dc=com" --disableldapauth --enablekrb5 \ --krb5kdc=instructor.example.com --krb5adminserver=instructor.example.com \ --krb5realm=EXAMPLE.COM --enablesssdauth --update

• Packages required:

  • yum groupinstall directory-client

  • yum install openldap-clients

  • yum install krb5-workstation

• Kerberos commands:

  • klist: List tickets.

  • kdestroy: Delete tickets.

  • kinit: Get new tickets.

  • Example:$ klist Ticket cache: FILE:/tmp/krb5cc_1701_5hTCSt Default principal: ldapuser1@EXAMPLE.COM Valid starting Expires Service principal 08/05/13 12:35:36 08/06/13 12:35:35 krbtgt/EXAMPLE.COM@EXAMPLE.COM renew until 08/05/13 12:35:36 $ kdestroy $ klist klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_1701_5hTCSt) $ kinit Password for ldapuser1@EXAMPLE.COM: $ klist Ticket cache: FILE:/tmp/krb5cc_1701_5hTCSt Default principal: ldapuser1@EXAMPLE.COM Valid starting Expires Service principal 08/05/13 12:35:46 08/06/13 12:35:44

  • Offline LDAP and Kerberos servers can prevent login, but sssd can cache credentials allowing offline login

  • Edit the /etc/sssd/sssd.conf to configure SSSD.

  • Use authconfig to edit it via the command-line.

  • Service could be cached hiding a downed server.

  • Logging:

    • /var/log/sssd.

    • Increase verbosity in /etc/sssd/sssd.conf by adding debug_level=10 under [domain/default] (0 - 10).

It is oft repeated that the next wave of IT is automation. But automation is not new - it existed before in terms of automated installation, sending birthday mails etc. 

It was not untill you actually work in large IT Infrastructure that you realise what is running in the background. The chances of working on Unix / Linux servers in telecom, manufacture or banking is very high. And most of the routine tasks including installation and upgrade would be automated. You touch the shell scripting at this stage - directly or indirectly. 

The shell scripts are often confused with shell commands. That should not be the case. 

Shell commands forms the basis of the scripts. But as with other programming languages, shell scripts also have advanced concepts.

Also, there are no alternate to shell scripts if you want to have something automated in boot / console mode of unix / linux systems. 

Hence, sufficient knowledge of shells and related scripts is must for any system administrator to become a 'Pro' - now and in future.