# on the sudo-client: tar xzf sudo-1.6.8p12.tar.gz cd sudo-1.6.8p12 ./configure --with-ldap --prefix=/opt/soft_sudo-1.6.8p12 make -j4 && make install # on ldap-server: # new schema for the ldap-directory, file /opt/soft_openldap-2.3.31/etc/openldap/schema/sudo.schema: ----------------------------- # # schema file for sudo # attributetype ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) objectclass ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL DESC 'Sudoer Entries' MUST ( cn ) MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoOption $ description ) ) ----------------------------- # and add 'include /opt/soft_openldap-2.3.31/etc/openldap/schema/sudo.schema' to slapd.conf # data to be written to the ldap-directory: ----------------------------- dn: ou=sudoers,dc=fluxcoil,dc=net objectClass: top objectClass: organizationalUnit ou: sudoers dn: cn=defaults,ou=sudoers,dc=fluxcoil,dc=net objectClass: top objectClass: sudoRole cn: defaults description: Default sudoOption's go here sudoOption: env_reset dn: cn=tester0,ou=sudoers,dc=fluxcoil,dc=net objectClass: top objectClass: sudoRole cn: tester0 sudoUser: tester0 sudoHost: ALL sudoCommand: /bin/bash sudoOption: !authenticate ----------------------------- # add 2 options to clients /etc/ldap.conf: ----------------------------- sudoers_base ou=sudoers,dc=fluxcoil,dc=net sudoers_debug 0 # use 1 or 2 for debugging ----------------------------- # now on client as tester0: tester0@rhel4:~$id uid=10000(tester0) gid=10000(group0) groups=10000(group0) tester0@rhel4:~$/opt/soft_sudo-1.6.8p12/bin/sudo /bin/bash root@rhel4:~$id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)