User profile for user: dtdionne
dtdionne Author
User level: Level 1
8 points

SUDO and SU issue when authenticated by Active Directory

Greetings...I have searching the net pretty extensivelly but have to admit that I am too frustrated to search here for the answer, I'm just posting...so please forgive me and I hope to be able to forgive myself becuase of how much I HATE seeing the same question asked 294892948503958392028590 times cause people don't spend .023848302 milliseconds on a simple search.

Anyway, I have really struggled with Active Directory integration....mainly because NOWHERE, ANYWHERE, in any of the Apple doc's did they touch on the VERY VERY VERY IMPORTANT nugget of wisdom that states:

YOU CAN NOT...I REPEAT, YOU CAN NOT HAVE A PRE-EXISTING LOCAL USERNAME THAT IS THE SAME AS AN ACTIVE DIRECTORY USERNAME

And considering that I only have one name I fell face first into this gem of a tar pit. Well i got that cleared up but I have to admit that it was no walk in the park....felt more like friggin brain surgery.

So, here I am finally logged into my Mac via Active Directory, got my home drive mounting and caching, just about to unleash this on our organization when I luckely decided to load nmap from MacPorts only to find out that sudo and su do not work. Now get this...

[david@Mackie on Sun Dec 17 at 09:42 AM ~]$su -l
Password:
su: Sorry
[david@Mackie on Sun Dec 17 at 09:42 AM ~]$tail -3 /var/log/secure.log
Dec 17 10:03:16 Mackie com.apple.SecurityServer: authinternal authenticated user root (uid 0).

HOW KOOKIE IS THAT!!!!!!!

So in order to gain root, I have to su to a local user, then su to root.

Anyone?

MacBook Pro 15, MacBook Pro 15 Mac OS X (10.4.8)

Posted on Dec 17, 2006 8:07 AM

Reply
16 replies
User profile for user: Jerry Pringle
Jerry Pringle
User level: Level 4
1,460 points

Dec 17, 2006 8:28 AM in response to dtdionne

Hello,

I do understand what you mean, I got tripped up by a similar situation. You also can not have a local and LDAP user with the same name either!

In Applications/Utilities/Directory Access, Click to configure Active Directory. Click to show advanced options, then on the Administrative tab, click to allow administration by Domain Administrators, that should then enable you do this.

I am assuming that you are a domain admin...

Let me know if that helps.

Herry
Reply
User profile for user: Steve Herman1
Steve Herman1
User level: Level 4
2,577 points

Dec 17, 2006 8:39 AM in response to Jerry Pringle

By default AD users will be logged in as non-admins.

And it's been my experience that even if you add an AD group to the list of admin groups in Directory Access... and login with an AD account that's a member of that group... that sudo still doesn't work. Seems strange though because if you use "id" in Terminal the user will be a member of the "admin" group.

I don't know that I've ever tried this with an account that's specifically in AD "Domain Administrators" though. And I've never tried "su".

I've reported it as a bug to Apple but it's still listed as open in Bug Reporter. If you're seeing the same problem I'd suggest that you also file a bug report... the more reports the higher it'll bubble up in Apple's priority list.

Steve
Reply
User profile for user: dtdionne
dtdionne Author
User level: Level 1
8 points

Dec 17, 2006 8:50 AM in response to dtdionne

Hey Jerry and Steve, thanks for the quick replies...

Jerry, I have Domain Admins, Ent Admins, and my AD account entered in that part of the Directory Access tool and yes, my AD account is in all of the AD Admin Groups.

Steve, I will do the same...

What's really so strange is that my attempt to su or sudo IS authenticated...

To me, it "feels" like it might be a problem with the shell...you know, im gonna go try it with a different shell....be back in a sec....
Reply
User profile for user: Jerry Pringle
Jerry Pringle
User level: Level 4
1,460 points

Dec 17, 2006 9:51 AM in response to dtdionne

Jerry, can you su or sudo from your AD account?


Sorry, to be honest, I haven't tried. I have my machine bound to an AD domain, but do not use a domain account. As I use laptops, it was not worth the hassle in my opinion. I actually use a local account with the same username and password as my AD account, which allows for faster logins to network resources, as the Mac passes the username and password to the server which I am authenticating to.

Besides, I am not a domain admin within my company - I just look after firewalls and Macs here!

Jerry


Powerbook Ti G4 Gb Ethernet 15" 80GB, 1GB; 1.33GHz 15" G4 PowerBook 60GB, 1.5GB Mac OS X (10.4.8) Various other OSs - Including Win 2k, XP, Linux (x86 & PPC)
Reply
User profile for user: dtdionne
dtdionne Author
User level: Level 1
8 points

Dec 17, 2006 10:13 AM in response to dtdionne

Jerry, did I hear that correctly? You have can log into your Mac using the same account name as a local Mac machine account name? If so, how in the world did you get that to work?

When you get a chance could you add your AD account to the Admin group of your Mac (through the Directory Access tool of course) and then try to su or sudo?

What kinda firewalls is it that you admin? I just made a really really hard decision to go with SmoothWalls Advanced Firewall over my trustie Pix's or ASA's because of the cost...but i will say that Cisco has really done a lot to get the price of those suckers down as well as introduce a nice line of midrange models....but this was a tough call for me. My customer really needs enterprise class protection and functionality but they just don't have the funds therefore I choose the Smoothies, 20 of them to be precise...and being a veteran Unixian I of course love the cli... 🙂
Reply
User profile for user: Jerry Pringle
Jerry Pringle
User level: Level 4
1,460 points

Dec 17, 2006 11:08 AM in response to dtdionne

My local account username and password are the same as for my account in AD. The Mac is bound to AD, but I do not use an AD account on my Mac. I also have a PC on my desk as the main thing I use which requires windows authentication is Microsoft CRM (which will not work on a Mac any way we tried it).

So, unfortunately, I can not help much on this. I only really work with local accounts on the Mac, although if there is a corresponding account in AD, it allows for authentication. Working this way does not support network home folders etc, but that has not been an issue for me so far.

I work for an IT support outsourcer - so I work on a variety of firewalls. The main ones being Fortigate's (from Fortinet). We deal with some Pix's, but they are difficult to get VPNs to work with Macs in my experience - the Cisco VPN client falls over alot!

Also the Fortigate gives you virus and spam filtering abilities as well as web content filtering and intrusion prevention signatures etc. All in all a much more feature rich product than the Pix.

Jerry
Reply
User profile for user: dtdionne
dtdionne Author
User level: Level 1
8 points

Dec 17, 2006 11:35 AM in response to Jerry Pringle

I forgot to mention that when I do gain root via a local admin account the prompt remains a $ although whoami confirms my root status and I am able to do root stuff.




OFF-TOPIC:

Hey Jerry, I guess this forum doesnt have PM's, could you drop me an email at david@dionne.net? I have been evaluating CRM's for the last 5 years, would you mind chatting about Microsoft's? I've had the install cd's since version 1 but just havent pulled the trigger...
Reply
User profile for user: Steve Herman1
Steve Herman1
User level: Level 4
2,577 points

Dec 17, 2006 3:18 PM in response to dtdionne

When you get a chance could you add your AD account
to the Admin group of your Mac (through the Directory
Access tool of course) and then try to su or sudo?


From my testing you can add user accounts to the list in Directory Access but it doesn't have any effect. I think Directory Access only recognizes AD groups in the list and elevates members of those groups to admins... but even if you login with an ID that's a member of one of the AD groups you still have the sudo problem.

Steve
Reply

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

SUDO and SU issue when authenticated by Active Directory

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.
Learn more Sign up