<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.MsoDate, li.MsoDate, div.MsoDate
{mso-style-priority:99;
mso-style-link:"Datum Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.DatumZchn
{mso-style-name:"Datum Zchn";
mso-style-priority:99;
mso-style-link:Datum;
font-family:"Calibri",sans-serif;}
span.E-MailFormatvorlage19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.E-MailFormatvorlage20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.E-MailFormatvorlage21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.E-MailFormatvorlage22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hi Dagobert,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">It looks like we ran into a new issue and I hope you are the right person to contact. At least I can see that the package (I think) is involved has been packaged by you.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I have recently done an upgrade of a few packages including sudo and sudo_ldap on a few nodes. The former versions were as follows:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">CSWsudo à VERSION: 1.8.16,REV=2016.03.18<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">CSWsudo-ldap à VERSION: 1.8.16,REV=2016.03.18<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The new versions are:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">CSWsudo à VERSION: 1.8.18,REV=2016.09.21<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">CSWsudo-ldap à VERSION: 1.8.18,REV=2016.09.21<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Interestingly on the servers with the older version and also on the servers with the newer version the command /opt/csw/bin/pkgutil --version CSWsudo-ldap shows 2.6.7. So it looks like it is in fact the same
package.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">The issue that we have is that since I have upgraded the sudo packages LDAP users are not able anymore to use sudo as it seems that the information from the LDAP server is not received.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">This example output is from a server where sudo works:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#1F497D">pts/23|root@fr4u-gen-chs-app001:/root# sudo su - g701806<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">sudo: start_tls specified but LDAP libs do not support ldap_start_tls_s() or ldap_start_tls_s_np()<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Oracle Corporation SunOS 5.10 Generic Patch January 2005<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">LOGIN NAME: g701806<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">ORACLE DATABASE: chdev<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Clearing House profile executed.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">development environment for server fr4u-gen-chs-app001 set!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">fr4u-gen-chs-app001:DEVELOP\&chdev\&/ldap/home/g701806: sudo su -<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">sudo: start_tls specified but LDAP libs do not support ldap_start_tls_s() or ldap_start_tls_s_np()<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Oracle Corporation SunOS 5.10 Generic Patch January 2005<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">pts/23|root@fr4u-gen-chs-app001:/root# ^D<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">fr4u-gen-chs-app001:DEVELOP\&chdev\&/ldap/home/g701806: sudo -l<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">sudo: start_tls specified but LDAP libs do not support ldap_start_tls_s() or ldap_start_tls_s_np()<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Matching Defaults entries for g701806 on fr4u-gen-chs-app001:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> loglinelen=0, logfile=/var/adm/sudolog, ignore_dot, !mail_no_user, log_host, logfile=/var/log/sudolog, !syslog,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> timestamp_timeout=10, !authenticate<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">User g701806 may run the following commands on fr4u-gen-chs-app001:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:9.6pt"><span style="color:#1F497D">(root) ALL<o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:9.6pt"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">This example output is from a server where sudo does not work:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#1F497D">pts/5|root@fr4u-gen-chs-app002:/var/log# sudo su - g701806<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">sudo: start_tls specified but LDAP libs do not support ldap_start_tls_s() or ldap_start_tls_s_np()<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Oracle Corporation SunOS 5.10 Generic Patch January 2005<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">LOGIN NAME: g701806<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">ORACLE DATABASE: chdev<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Clearing House profile executed.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">development environment for server fr4u-gen-chs-app002 set!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">fr4u-gen-chs-app002:DEVELOP\&chdev\&/ldap/home/g701806: sudo su -<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">sudo: start_tls specified but LDAP libs do not support ldap_start_tls_s() or ldap_start_tls_s_np()<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">g701806 is not allowed to run sudo on fr4u-gen-chs-app002. This incident will be reported.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">fr4u-gen-chs-app002:DEVELOP\&chdev\&/ldap/home/g701806: sudo -l<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">sudo: start_tls specified but LDAP libs do not support ldap_start_tls_s() or ldap_start_tls_s_np()<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Sorry, user g701806 may not run sudo on fr4u-gen-chs-app002.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I am not sure if this output helps, but I have added a line to sudo.conf to debug sudo. So here is what appears in the sudo_debug log when I execute the command “sudo su –“ on the server where sudo works:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:42 sudo[535884] settings: progname=sudo<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:42 sudo[535884] settings: network_addrs=10.161.120.146/255.255.254.0 10.161.146.17/255.255.255.0 10.161.146.25/255.255.255.0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:42 sudo[535884] settings: plugin_dir=/opt/csw/libexec/sudo/<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] policy plugin returns 1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] settings: progname=sudo<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] settings: network_addrs=10.161.120.146/255.255.254.0 10.161.146.17/255.255.255.0 10.161.146.25/255.255.255.0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] settings: plugin_dir=/opt/csw/libexec/sudo/<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] command info from plugin:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] 0: command=/usr/bin/su<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] 1: runas_uid=0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] 2: runas_gid=0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] 3: runas_groups=0,1,2,3,4,5,6,7,8,9,12<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] 4: closefrom=3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] 5: set_utmp=true<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] 6: umask=022<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] executed /usr/bin/su, pid 535901<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] sudo_ev_add_v1: adding event 44628 to base 4b4d0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] sudo_ev_add_v1: adding event 44668 to base 4b4d0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] signal pipe fd 7<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] backchannel fd 9<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535901] exec /usr/bin/su [su -]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] sudo_ev_scan_impl: 1 fds ready<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] failed to read child status: EOF<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:13:43 sudo[535884] sudo_ev_del_v1: removing event 44668 from base 4b4d0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">And here is the output from the server where sudo does not work:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:12:02 sudo[152587] will restore signal 13 on exec<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:12:02 sudo[152587] settings: progname=sudo<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:12:02 sudo[152587] settings: network_addrs=10.161.120.147/255.255.254.0 10.161.146.18/255.255.255.0 10.161.146.26/255.255.255.0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:12:02 sudo[152587] settings: plugin_dir=/opt/csw/libexec/sudo/<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Nov 7 11:12:02 sudo[152587] policy plugin returns 0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks and Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">...................................................................................................................<o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:black;mso-fareast-language:DE">Dipl.-Ing. Stefan Maaß</span></b><b><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;mso-fareast-language:DE">
</span></b><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">| System Support UNIX/DB</span><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:#002060;mso-fareast-language:DE"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">+49 (6142) 7383 574 office | +49 (6142) 7383 33 574 fax<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="DE" style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:black;mso-fareast-language:DE">Syniverse Technologies GmbH</span></b><b><span lang="DE" style="font-size:9.0pt;font-family:"Tahoma",sans-serif;mso-fareast-language:DE">
</span></b><span lang="DE" style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">|<b>
</b>Eisenstraße 9b, 65428 D-Rüsselsheim<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE" style="mso-fareast-language:DE"><a href="mailto:stefan.maass@syniverse.com"><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray">stefan.maass@syniverse.com</span></a></span><span lang="DE" style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">
| </span><span lang="DE" style="mso-fareast-language:DE"><a href="http://www.syniverse.com/"><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray">www.syniverse.com</span></a></span><span lang="DE" style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">...................................................................................................................<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="DE" style="mso-fareast-language:DE"><a href="http://www.facebook.com/Syniverse.Technologies"><span lang="EN-US" style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray">Find Syniverse</span></a></span><span lang="DE" style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">
</span><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">on Facebook | </span><span lang="DE" style="mso-fareast-language:DE"><a href="http://twitter.com/Syniverse"><span lang="EN-US" style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray">Follow
Syniverse</span></a></span><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE"> on Twitter
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:DE"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="DE" style="font-size:8.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">Syniverse Technologies GmbH, Eisenstr. 9b, D-65428 Rüsselsheim<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="DE" style="font-size:8.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="DE" style="font-size:8.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">Geschäftsführung: Dr. Guido Reißner, Laura E. Binion, Bob Francis Reich, Thomas P.Ford<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="DE" style="font-size:8.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="DE" style="font-size:8.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">Amtsgericht Darmstadt, HRB 84288
<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="DE" style="font-size:8.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">USt-ID: DE814572551<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="DE" style="font-size:8.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:8.0pt;font-family:"Tahoma",sans-serif;color:gray;mso-fareast-language:DE">The information in this email and in any attachments is confidential and intended solely for the attention and use of the named
addressee(s). This information may be subject to legal, professional or other privilege or may otherwise be protected by work product immunity or other legal rules. It must not be disclosed to any person without our authority. If you are not the intended recipient,
or a person responsible for delivering it to the intended recipient, you are not authorised to and must not disclose, copy, distribute, or retain this message or any part of it. Please contact the sender by reply e-mail and destroy all copies of the original
message.</span><b><span lang="EN-GB" style="font-size:10.0pt;color:blue;mso-fareast-language:DE"><o:p></o:p></span></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>