Score:0

Using active directory group as netgroup in sssd

in flag

I have an active directory domain with a handful of linux servers that interact with AD through sssd. I want to have a different sudoers configuration on different servers, and I know this can be done through netgroups. So far, I've managed to get some servers into a netgroup by adding a nisNetgroup object in AD, and adding servers to the nisNetgroupTriple attribute on that object (and setting the ldap_netgroup_search_base option in sssd.conf). As a result, I can query the netgroup successfully on the linux servers using getent:

$ getent netgroup <name>
<name>         (<server>.<domain>,,)

Changing netgroup membership is done by modifying the nisNetgroupTriple attribute of the nisNetgroup object. This means a user with permission to modify the object can put any server into the netgroup. I would like to lock this down further, for example by using a standard AD group, where a user would need to have permission to modify the group and the computer account in order to add the computer to the group. Is it possible to have sssd use a standard AD group as a netgroup?

cn flag
Is the computer account in AD?
Peter Lubans avatar
in flag
It is. The Linux servers are all joined to the domain using the "realm join" command.
cn flag
Adding a member to a group does not require permissions for the member as only the group is modified.
Peter Lubans avatar
in flag
You're right... I just tested this and I only needed permissions for the group. Thanks Greg.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.