[sudo-users] sudo SSL Solaris
Beate.Kleymann at HVBIS.com
Beate.Kleymann at HVBIS.com
Wed Jun 14 08:30:42 EDT 2006
Hello !
I try to get sudo with pam and ldap support plus ssl working.
We have Solaris 8 and 9 native clients.
Users authenticate using Sun One Directory Server 5.2
Next we would like to migrate our sudoers information into the Directory
Server.
I was able to compile sudo-1.6.8p8 with ldap and pam support:
# ./configure --with-ldap=/usr --with-pam
Everything works fine as long as I don't use SSL.
If I turn on SSL in the /etc/ldap.conf sudo will not work any more.
I tried different Entries in the ldap.conf
bash-2.05$ more /etc/ldap.conf
host ldaptest.intranet.hypovereinsbank.de
port 636
sudoers_base ou=sudoers,dc=tsy2,dc=hvb,dc=de
binddn uid=XXXXXX,ou=People,dc=hvb,dc=de
bindpw XXXXXX
TLS_REQCERT allow
tls_checkpeer yes
tls_cacertdir /var/ldap
#tls_cert /var/ldap/cert7.db
#tls_key /var/ldap/key3.db
sudoers_debug 2
Using SSL the sudo will hang. It is not reading out the SSL Parameters
from the ldap.conf file.
bash-2.05$ ./sudo /usr/sbin/ifconfig -a
LDAP Config Summary
===================
host ldaptest.intranet.hypovereinsbank.de
port 636
ldap_version 3
sudoers_base ou=sudoers,dc=tsy2,dc=hvb,dc=de
binddn uid=XXXXXX,ou=People,dc=hvb,dc=de
bindpw XXXXXX
===================
ldap_init(ldaptest.intranet.hypovereinsbank.de,636)
ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,0x03)
libs used:
bash-2.05$ ldd ./sudo
libpam.so.1 => /usr/lib/libpam.so.1
libdl.so.1 => /usr/lib/libdl.so.1
libldap.so.5 => /usr/lib/libldap.so.5
libsocket.so.1 => /usr/lib/libsocket.so.1
libnsl.so.1 => /usr/lib/libnsl.so.1
libc.so.1 => /usr/lib/libc.so.1
libcmd.so.1 => /usr/lib/libcmd.so.1
librt.so.1 => /usr/lib/librt.so.1
libmd5.so.1 => /usr/lib/libmd5.so.1
libmp.so.2 => /usr/lib/libmp.so.2
libaio.so.1 => /usr/lib/libaio.so.1
/usr/platform/SUNW,Ultra-5_10/lib/libc_psr.so.1
/usr/platform/SUNW,Ultra-5_10/lib/libmd5_psr.so.1
I tried to find a solution in the mailing list archive, but I'm still
not sure if it is possible to use SSL with native solaris ldap clients
or not.
Security is very strikt and I'm afraid we are not allowed to transfer
sudo entries over the network without using SSL.
I'm quite familiar with the Directory Server but I don't have enough
knowledge how sudo works.
Your help would be much appreciated.
Best Regards,
Beate
More information about the sudo-users
mailing list