Note: SUDOers LDAP is an add-on feature
To enable this feature, contact us at [email protected] or via the Intercom chat
Foxpass allows you to manage your SUDOer configuration through our LDAP interface. Generally, Foxpass allows certain users to use sudo on hosts. With this feature, you can restrict or allow sudo commands and options to users or groups on your hosts.
An LDAP SUDOer entry consists of 7 different attributes:
- Which users (or groups) the rules apply to
- Which hosts the rules apply to
- What commands can or cannot be run
- Any environment specific options
- Any users or groups that commands are allowed or prohibited to "run as"
- An optional start or end time when the entry is valid
- An 'order' value which establishes which entries take precedence if they have conflicting rules
To read more about SUDOers and the differences between a regular SUDOers configuration and an LDAP configuration, check out the links below:
The biggest difference between a regular SUDOers file and an LDAP SUDOers entry is that order isn't guaranteed in LDAP. Order can be achieved in LDAP by specifying an 'order' value. Order is 0 by default, and higher numbers take precedence.
Additionally, there is a 'Defaults' section to set default options that apply to all users. Any variables in the 'Defaults' section will apply globally to all users.
Enter in any default SUDO options you would like to apply globally in the 'SUDOer Default' section.
Here's a list of some common options:
For instance, the defaults pictured above will allow all those with sudo access to run commands without using a password.
Create an entry and give it a name. By default, and at a minimum, all SUDOer entries must specify a single or set of users (or groups), what hosts the entry applies to, and what commands can be run. If you try removing all of that type's entries, a default of 'ALL' will be set.
Note: SUDOer Entries are static, not dynamic
This means that if you change a user or group name in Foxpass you will have to manually update the SUDOer entry
Configure the SUDOer entry by adding settings to the different fields. The enabled/disabled flag is the equivalent of adding a "!" to the front of the setting.
For complex variables, like options, be sure to enter in the entire string. For example, if you'd like to preserve the SSH_AUTH_SOCK variable enter this 'env_keep+=SSH_AUTH_SOCK'.
The entry pictured above will allow all members of the "security" group, except for user "richard," to run the ls and cd commands on any host.
Updated about a year ago