Wednesday, March 23, 2022

[389-users] Re: Netrgoups referenced in the SUDOers Group do not work

Hi Simon


On the server:

[root@testldap01 ~]# rpm -qa 389*




On the client:

[root@testldapclient01 log]# rpm -qa *ldap*








The sudo logs say according to A.2. Troubleshooting sudo with SSSD and sudo Debugging Logs Red Hat Enterprise Linux 7 | Red Hat Customer Portal:

[root@testldapclient01 log]# grep testldapclient01 sudo_debug.log

Mar 23 09:56:53 sudo[22331] <- sudo_new_key_val_v1 @ ./key_val.c:56 :=

Mar 23 09:56:53 sudo[22331] user_info:

Mar 23 09:56:53 sudo[22331] keep YES

Mar 23 09:56:53 sudo[22331] sudo_putenv:

Mar 23 09:56:53 sudo[22331] netgroup ABX_server_test matches (|testldapclient01, , false @ netgr_matches() ./match.c:1228

Mar 23 09:56:53 sudo[22331] host testldapclient01 matches sudoers pattern +ABX_server_test: false @ hostname_matches() ./match.c:997


The client can resolve the referenced netgroup:

[root@testldapclient01 log]# getent netgroup ABX_server_test

ABX_server_test       (testldapclient01,-,-) (,-,-)


As I interpret the logs:

1.    The client sees, that the hostname it is installed on is (sudo_putenv:

2.    The client sees the referenced netgroup ABX_server_test with the server within.

3.    The client compares the system hostname with the hostname in the netgroup and finds no match.


To exclude typos, I copied the return of the hostname command in the referenced netgroup of my Apache Studio. I do not understand, why there is no match, as the hostnames are identical.


If I set the hostname directly in the Apache Studio SUDOers group with the attribute sudoHost, it works. If I set +ABX_server_test, it fails.


Further logs

·         Messages: Mar 23 09:56:38 testldapclient01 sssd[be[LDAP]]: Starting up

Mar 23 09:56:38 testldapclient01 sssd[be[LDAP]]: Your configuration uses the autofs provider with schema set to rfc2307 and default attribute mappings. The default map has changed in this release, please make sure the configuration matches the server attributes.

The other logfiles contain no information regarding the hostname.


I could solve the same issue with the sudoUser attribute, by renaming the netgroup. Renaming the netgroup for the sudoHost did not help.


My netgroup entry is


Thanks a lot. If you need any more information or logs, please let me know.





Von: Simon Pichugin <>
Gesendet: Mittwoch, 23. März 2022 00:32
An: General discussion list for the 389 Directory server project. <>
Betreff: [389-users] Re: Netrgoups referenced in the SUDOers Group do not work


Hi Tibor,

To give you more helpful advice, we'll need more info.


What package versions do you use?

Can you attach your server (access and error logs) and SSSD logs?

Also, it'll be helpful to see your netgroup entry and other related configuration.





P.S. I'd recommend also asking on as they would have more experience with this kind of issue, AFAIK. 


On Tue, Mar 22, 2022 at 5:48 AM Dudas Tibor ABRAXAS <> wrote:



My SUDOers group works with a dedicated sudoUser given, but not if I reference a Netgroup with the User given there.

Same for sudoHost.


Works not:




The netgroups can be resolved on the 389ds client, though:

[root@testldapclient01 ~]# getent netgroup ABX_user_test

ABX_user_test         ( ,axtsc,)


[root@testldapclient01 ~]# getent netgroup ABX_server_test

ABX_server_test       (testldapclient01,-,-) (,-,-)


Changes in the SUDOers Group work only with some delay. Restart of sssd and relogin does not help. So it is a bit clumsy to test. Any help is highly appreciated.


Thanks, Tibor



389-users mailing list --
To unsubscribe send an email to
Fedora Code of Conduct:
List Guidelines:
List Archives:
Do not reply to spam on the list, report it:

No comments:

Post a Comment