-
Story
-
Resolution: Unresolved
-
Undefined
-
None
-
None
-
None
-
Low
-
rhel-idm-sssd
-
ssg_security
-
None
-
False
-
False
-
-
None
-
None
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
None
Propose:
Add a README file in /etc/sudoers.d to provide information in regards to excluded filename, i.e.
The @includedir directive can be used to create a sudoers.d directory
that the system package manager can drop sudoers file rules into as part
of package installation. For example, given:@includedir /etc/sudoers.d
sudo will suspend processing of the current file and read each file in
/etc/sudoers.d, skipping file names that end in ‘~’ or contain a ‘.’
character to avoid causing problems with package manager or editor tem‐
porary/backup files.Files are parsed in sorted lexical order. That is,
/etc/sudoers.d/01_first will be parsed before /etc/sudoers.d/10_second.
Be aware that because the sorting is lexical, not numeric,
/etc/sudoers.d/1_whoops would be loaded after /etc/sudoers.d/10_second.
Using a consistent number of leading zeroes in the file names can be
used to avoid such problems. After parsing the files in the directory,
control returns to the file that contained the @includedir directive.
Users from AD via trust are often with a dot in username. It is a common mistake to put a drop-in file with username and the file is being ignored due to "." included in filename.