can I give an Active Directory group sudo permissions?

[Luke Jaeger]

I'm running a FreeNAS 9.10 fileserver bound to AD. All users (except the local admin) log in with their AD credentials to get access to their home directory, SMB shares, etc.

I would like one of the existing AD groups to have sudo rights on my FreeNAS. Is this possible?

 

[anodos]

I'm running a FreeNAS 9.10 fileserver bound to AD. All users (except the local admin) log in with their AD credentials to get access to their home directory, SMB shares, etc.

I would like one of the existing AD groups to have sudo rights on my FreeNAS. Is this possible?

At present (as far as I can tell) there doesn't appear to be a way to make it persistent across reboots. What are you trying to accomplish? There's not a lot of configuration that can be achieved via the CLI (at least in a way that's stable).

I think it's not a bad idea to have a checkbox in the "directory services" -> "active directory" config to automatically add "DOMAIN\Domain Admins" to the sudoers file.

 

[Luke Jaeger]

At present (as far as I can tell) there doesn't appear to be a way to make it persistent across reboots. What are you trying to accomplish? There's not a lot of configuration that can be achieved via the CLI (at least in a way that's stable).

I have a bunch of scripts that run daily via cron, as root. I'd like members of one AD group to be able to run the script by hand when they want to. The script involves git commands which require sudo rights, so it wouldn't be enough to just give them a copy of the script that they own.

I'm prepared for the possibility that the git commands are the obstacle here, not the user's permissions

 

[anodos]

I have a bunch of scripts that run daily via cron, as root. I'd like members of one AD group to be able to run the script by hand when they want to. The script involves git commands which require sudo rights, so it wouldn't be enough to just give them a copy of the script that they own.

I'm prepared for the possibility that the git commands are the obstacle here, not the user's permissions

It might be worth making a feature request to add domain groups to the sudoers file.

 

[averyfreeman]

According to everything I've read, git is supposed to work solely based on the access permissions of the present directory -- however, I just logged into my server as a domain user and navigated to a directory that domain user owns, and I cannot use git without sudo.

Do you have any idea why? Is it a FreeNAS specific issue?

 

[Ender117]

At present (as far as I can tell) there doesn't appear to be a way to make it persistent across reboots. What are you trying to accomplish? There's not a lot of configuration that can be achieved via the CLI (at least in a way that's stable).

I think it's not a bad idea to have a checkbox in the "directory services" -> "active directory" config to automatically add "DOMAIN\Domain Admins" to the sudoers file.

Hi sorry to revive an old thread but this is the closest post I can find. Basically I ran into the same thing that I can log in with domain accounts but cannot sudo. Just want to make sure it's still not possible before I submit a feature request.

 

[anodos]

Hi sorry to revive an old thread but this is the closest post I can find. Basically I ran into the same thing that I can log in with domain accounts but cannot sudo. Just want to make sure it's still not possible before I submit a feature request.

It's currently not possible to do this.

 

[Ender117]

It's currently not possible to do this.

Thanks, I submitted a feature request. This may not be of high demand but hopefully it is easy enough so it gets implemented

 

[jg3]

It would make sense that I can create a "sudoers" group in AD and add the users to that group which I want to give sudo access to. Unfortunately this has been a pain for a while (for those of us who want to manage all the credential info in AD)

https://www.ixsystems.com/community/threads/ad-user-cant-sudo.61242/#post-435657

 

[Ender117]

It would make sense that I can create a "sudoers" group in AD and add the users to that group which I want to give sudo access to. Unfortunately this has been a pain for a while (for those of us who want to manage all the credential info in AD)

https://www.ixsystems.com/community/threads/ad-user-can't-sudo.61242/#post-435657

My feature request got turned down by iXsystem, seems that they have bigger problems at hand and/or TrueNAS customers are not bugged by this