[sudo-users] Offtopic: Re: sudo + ldap - nisNetgroupTriple

[Patrick Spinler]

On 05/26/2010 09:16 AM, Jr Aquino wrote:

> As such, I'd like to have a list of hosts that both sudo and pam_ldap
> can look to without having to duplicate the same data in 2 different
> formats.

Here's where I'd urge you to give careful consideration to your 
approach.  You're talking about using the same object type for 
semantically different purposes, and in fact to contain different objects.

*) A group of hosts for use in sudo rules
*) A group of users for use in sudo rules
*) A group of users to provision to a host

In fact, these are all different, and *should* be represented 
differently in your repository.  We do something like this:

auth_<somegroup>   - a list of people provisioned to a host
sudo_<somegroup>   - a list of people granted a specific sudo command
hgrp_<somegroup>   - a list of hosts

Even in the first two instances, provisioning v. sudo, I *want* to keep 
these separate.  For example, when an intern joins our unix team for a 
summer assignment, I probably want to allow that intern to log into our 
machines so she can e.g. gather configuration info, but I probably don't 
want to grant that intern the full sudo rights I give normal unix admins.

-- Pat