Hi,<div><br></div><div>I have configured SUDO with OpenLDAP.  I have created a group called &quot;sysadm&quot; and assign the below commands which the users belong to this group can execute.  Now created a user called &quot;bob&quot; and assign him to this group.  When am logging in as bob, and run</div>

<div>&quot;sudo -l&quot;, its asking me for the password and after i put the correct password its showing me the &quot;sudoCommand&quot; list.  But it also executes the command &quot;!/sbin/route&quot; too which he should not able to execute, why its happening? did i do anything wrong.</div>

<div><br></div><div><div>dn: cn=%sysadm,ou=SUDOers,dc=example,dc=com</div><div>objectClass: top</div><div>objectClass: sudoRole</div><div>cn: %sysadm</div><div>sudoUser: %sysadm</div><div>sudoHost: ALL</div><div>sudoOption: !authenticate</div>

<div>structuralObjectClass: sudoRole</div><div>entryUUID: d6819d80-5c39-1030-9d7c-19f66ff1c84f</div><div>creatorsName: cn=Manager,dc=example,dc=com</div><div>createTimestamp: 20110816095703Z</div><div>sudoCommand: /sbin/shutdown</div>

<div>sudoCommand: /sbin/halt</div><div>sudoCommand: /sbin/reboot</div><div>sudoCommand: /sbin/yast</div><div>sudoCommand: /sbin/yast2</div><div>sudoCommand: /sbin/date</div><div>sudoCommand: /sbin/kill</div><div>sudoCommand: /usr/bin/killall</div>

<div>sudoCommand: /usr/bin/passwd</div><div>sudoCommand: /bin/su</div><div>sudoCommand: /bin/rpm</div><div>sudoCommand: /sbin/ifconfig</div><div>sudoCommand: /sbin/ifup</div><div>sudoCommand: !/sbin/route</div>
<div>entryCSN: 20110826090949.582253Z#000000#000#000000</div><div>modifiersName: cn=manager,dc=example,dc=com</div><div>modifyTimestamp: 20110826090949Z</div><div><br></div><div>Regards,</div><div>Neo</div><br><div class="gmail_quote">
On Wed, Aug 10, 2011 at 10:11 AM, pradyumna dash <span dir="ltr">&lt;<a href="mailto:neomatrixgem@gmail.com" target="_blank">neomatrixgem@gmail.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span style="font-family:tahoma,sans-serif">Guys,</span><br style="font-family:tahoma,sans-serif"><br style="font-family:tahoma,sans-serif">

<span style="font-family:tahoma,sans-serif">I have a query, lets take a scenario :</span><br style="font-family:tahoma,sans-serif">
<br style="font-family:tahoma,sans-serif"><span style="font-family:tahoma,sans-serif">Assume we have 2 servers &quot;Server1&quot; and &quot;Server2&quot; and 2 groups &quot;Admin&quot; and 
&quot;ITTech&quot;, What is needed is like say when a user &quot;bob&quot; logging <br>in to &quot;Server1&quot; 
he will get the group &quot;Admin&quot;, but when he logs in to &quot;Server2&quot; he will get 
group &quot;ITTech&quot;.  Also it may vary for different users <br>like when &quot;Kris&quot; logs in 
to Server1 he may get a group called &quot;ITTech&quot; and when he logs in to &quot;Server2&quot;  
he will get some other group say &quot;Security&quot;. <br>Can it be possible by OpenLDAP ? If this is achieved then we are planning to have SUDO files based on the grooups.</span><br style="font-family:tahoma,sans-serif">


<br style="font-family:tahoma,sans-serif"><span style="font-family:tahoma,sans-serif">It would be great if you can provide me some pointers or how-to.</span><br style="font-family:tahoma,sans-serif"><br style="font-family:tahoma,sans-serif">


<span style="font-family:tahoma,sans-serif">Regards,</span><br style="font-family:tahoma,sans-serif"><span style="font-family:tahoma,sans-serif">Neo</span><br>
</blockquote></div><br></div>