How-to
This is a short how-to in staging a SUDO master which is the - text file - repository where the pristine sources of all SUDO fragment files, management scripts and configuration files will be held.
The requirements for a SUDO master repository are almost negligible in terms of disk space and CPU resources. However, when triggering a key distribution process, a number of parallel SSH sessions will be spawned which will take up some system resources (see MAX_BACKGROUND_PROCS
setting in the manage_sudo.sh
script). By default this is set to 30.
In terms of network and firewall configurations: all SUDO controls client hosts must be reachable through SSH (standard port 22) from the SUDO master.
The basic steps to configure a SUDO master are (as root user):
- Add a dedicated OS group & user - for example
sudoadmin
- who will be the owner of the repository. The administrative account does not need a password (so lock it) but does require a valid shell:
[master]$ groupadd sudoadmin
[master]$ useradd -g sudoadmin sudoadmin
- Create the repository:
[master]$ mkdir -p /etc/sudo_master
[master]$ chown -R sudoadmin:sudoadmin /etc/sudo_master
- Create a SSH key pair for the
sudoadmin
user. This key pair will be used to authenticate on each of the SUDO controls client systems when doing an update. If you opt to create a key with passphrase then you must:- make sure you have a SSH agent process running on either SUDO master server or your the machine you are originally connecting from (with agent forwarding enabled).
- add this key to the running SSH agent. Failing to do will block any remote update process to client hosts.
- distribute the public key to all SUDO controls hosts. You can use SSH Controls for this purpose.
- Create the fragments repository with the rules that need to be distributed. You can choose to either store all rules in one big file or use a
fragments.d
directory with separate rule files. (see Master configuration files for more details):
[master]$ mkdir -p /etc/sudo_master/keys.d
[master]$ vi /etc/sudo_master/fragments.d/rules1.frag
[master]$ vi /etc/sudo_master/fragments.d/rules2.frag
...
[master]$ chown -R sudoadmin:sudoadmin /etc/sudo_master
- Create an initial version of the required master configuration files
[master]$ touch /etc/sudo_master/grants
[master]$ touch /etc/sudo_master/alias
[master]$ touch /etc/sudo_master/targets
[master]$ chown -R sudoadmin:sudoadmin /etc/sudo_master
Build/edit the grants
, alias
& targets
files to fit your environment.
- Copy the management scripts into the repository:
[master]$ cp source:update_sudo.pl /etc/sudo_master/
[master]$ cp source:manage_sudo.pl /etc/sudo_master/
[master]$ chown -R sudoadmin:sudoadmin /etc/sudo_master
[master]$ chmod ug+x /etc/sudo_master/update_sudo.pl
[master]$ chmod ug+x /etc/sudo_master/manage_sudo.sh
You may want to review the following settings in the manage_sudo.conf
or manage_sudo.conf.local
files, especially if you are not using the default /etc/sudo_master
& /etc/sudo_controls
paths:
Note: the REMOTE_DIR
& LOCAL_DIR
settings can also be specified as command-line parameters to the manage_sudo.sh
script.
- Copy or configure the client configuration file:
[master]$ cp source:update_sudo.conf /etc/sudo_master/
[master]$ chown -R sudoadmin:sudoadmin /etc/sudo_master
- Perform a syntax check on the configuration files:
[master]$ cd /etc/sudo_master
[master:/etc/sudo_master]$ ./manage_sudo.sh --check-syntax
INFO: *** start of manage_sudo.sh [--check-syntax] ***
INFO: logging takes places in /var/log/manage_sudo.sh.log
INFO: runtime info: LOCAL_DIR is set to: /etc/sudo_controls
INFO: ACTION: syntax-checking the configuration files ...
INFO: finished syntax-checking the configuration files
INFO: performing cleanup ...
INFO: *** finish of manage_sudo.sh [--check-syntax] ***
Note: the build-in syntax check has limited capabilities. It will not catch all possible errors so CAVEAT EMPTOR.
Example repository
Following is a listing of what a SUDO master repository may look like:
[master]$ ls -lR /etc/sudo_master
-rw-r----- 1 sudoadmin sudoadmin 4384 Apr 2 07:20 alias
drwxr-s--- 2 sudoadmin sudoadmin 1024 May 19 11:46 backup
drwxr-s--- 2 sudoadmin sudoadmin 3072 Feb 27 12:40 fragments.d
-rw-r----- 1 sudoadmin sudoadmin 3311 Mar 5 12:45 grants
-rw-r--r-- 1 sudoadmin sudoadmin 455 Dec 18 10:16 manage_sudo.conf
-rwxr-x--- 1 sudoadmin sudoadmin 38478 Apr 10 11:15 manage_sudo.sh
-rw-r----- 1 sudoadmin sudoadmin 809 Apr 2 07:19 targets
-rw-r--r-- 1 sudoadmin sudoadmin 926 Dec 18 10:16 update_sudo.conf
-rwxr-x--- 1 sudoadmin sudoadmin 24683 Feb 3 08:19 update_sudo.pl
./fragments.d:
-rw-rw---- 1 sudoadmin sudoadmin 5694 Feb 23 14:41 rules1.frag
-rw-rw---- 1 sudoadmin sudoadmin 374 Dec 3 08:41 rules2.frag
-rw-rw---- 1 sudoadmin sudoadmin 5554 Dec 3 08:39 rules3.frag
Comments