Centralizing Sudoers Policies via LDAP

You will push sudo permissions through your centralized directory service to enforce uniform policies.

In this lesson, you will learn how to shift sudo policy management from local /etc/sudoers files to a centralized LDAP directory to enforce consistent administrative privileges across your entire infrastructure.

Why Centralize Sudo?

Managing sudo manually on dozens or hundreds of servers is a recipe for configuration drift and security gaps. By storing sudoers rules within your LDAP directory, you treat administrative privileges like user identities: define them once, and they propagate to all client machines managed by SSSD.

The Mechanism: Sudoers Schema

To store these rules, your LDAP server must support the sudoers schema (typically provided by the sudo-ldap package). Within your LDAP directory, you create organizational units (OUs) to house these rules. Each rule is represented as an object with specific attributes:

sudoUser: Specifies which user or group the rule applies to.
sudoHost: Defines the machines where the rule is valid.
sudoCommand: Lists the binaries the user is allowed to execute.

For example, a rule defined in LDAP might look like this LDIF entry:

dn: cn=admin-group,ou=SUDOers,dc=example,dc=com
objectClass: sudoRole
cn: admin-group
sudoUser: %sysadmins
sudoHost: ALL
sudoCommand: ALL

Configuring the Client

For your Linux hosts to respect these LDAP-based policies, you must ensure the client is configured to look beyond the local filesystem. You instruct the system to query LDAP via the /etc/nsswitch.conf file by adding sudoers: files sssd.

Once SSSD is configured to fetch these rules—usually by adding sudo to the services line in your [domain/...] section of /etc/sssd/sssd.conf—the client will query the directory service whenever a user invokes sudo. The local /etc/sudoers file remains, but it acts only as a fallback or a container for local-only emergency accounts.

By centralizing these policies, you eliminate the need to push configuration files across the fleet. If you need to grant a developer temporary access or rotate an administrative group, you simply update the entry in LDAP, and every server in your environment reflects that change instantly.

Key Takeaway: Centralizing sudoers in LDAP allows you to manage granular administrative privileges as a global policy, ensuring consistent security and auditability across your entire enterprise.