3 ms·
Removing LDAP is a huge problem for the more important sudo deployments though: centralized management of permissions is kind of a vital function.
by XorNot 1y ago
Removing LDAP is a huge problem for the more important sudo deployments though: centralized management of permissions is kind of a vital function.
- Filligree 1y agoThose people can keep using sudo; it’s not going away. The rest of us get better security.
- immibis 1y agoHaving to type doas on systems without LDAP and sudo on systems with LDAP is abstraction leakage.
- fluidcruft 1y agoIs it actually removing ldap or is it offloading to pam?
- JoshTriplett 1y agoDebian is currently in the process of dropping the direct LDAP support in sudo, in favor of sssd. From sudo's NEWS.Debian.gz: > In practice, there are few installations that use sudo-ldap. Most installations that use LDAP as a directory service and sudo have now opted for sssd, sssd-ldap and libsss-sudo. > The Debian sudo team recommends the use of libsss-sudo for new installations and the migration of existing installations from sudo-ldap to libsss-sudo and sssd.
- XorNot 1y agoAh that makes more sense.
- dec0dedab0de 1y agoCould you clarify what you mean by more important sudo deployments?
- rnijveld 1y agoThe features we specifically don’t support are those related to direct LDAP support within sudo, so things like loading a sudoers file directly from LDAP. Sudo-rs will use any user retrieved via NSS, such as when configured using SSSD to load LDAP users. And from the authentication side you can use whatever PAM supports, so anything like Kerberos etc, which again can be coupled with the same LDAP database.