By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Linux EC2 - Domain Joined via SSM Document, visudo configuration not working

0

Hi all, I used the following doc to join my Linux EC2 instances to my (Directory Services) domain: https://docs.aws.amazon.com/directoryservice/latest/admin-guide/seamlessly_join_linux_instance.html

I then used this doc to edit the visudo file to provide root privileges to our domain admins: https://docs.aws.amazon.com/directoryservice/latest/admin-guide/join_linux_instance_winbind.html. Specifically, the very bottom, 11b --

"After the instance has restarted, connect to it with any SSH client and add the root privileges for a domain user or group to the sudoers list by performing the following steps -- Add the required groups or users from your Trusting or Trusted domain as follows, and then save it."

Adding Domain Users/Groups.

%domainname\AWS\ Delegated\ Administrators ALL=(ALL:ALL) ALL %domainname\groupname ALL=(ALL:ALL) ALL domainname\username ALL=(ALL:ALL) ALL %Trusted_DomainName\groupname ALL=(ALL:ALL) ALL Trusted_DomainName\username ALL=(ALL:ALL) ALL

However, on adding the default -- AWS Delegated Administrators, this doesn't work. I've tried every combination of capital or lowercase domain name but unfortunately, nothing seems to work.

Topics
Security, Identity, & ComplianceCompute
Tags
AWS Directory ServiceAmazon EC2Amazon Linux
Language
English
Adrian-Keith
asked 2 months ago424 views
1 Answer
0

Based on the information you've shared, it seems that the issue is specifically with the AWS Delegated Administrators group. The documentation you referenced suggests that you should be able to add this group to the sudoers list to grant the necessary privileges. However, it's possible that the group name or format is not being recognized correctly.

Here are a few things you can try: Verify the group name: Double-check the exact name of the AWS Delegated Administrators group in your directory service. Ensure that the spelling, capitalization, and any spaces are correct. [2]

Try different formats: In the sudoers file, you can try different formats for specifying the group, such as:

%domainname\AWS Delegated Administrators ALL=(ALL:ALL) ALL

%domainname"AWS Delegated Administrators" ALL=(ALL:ALL) ALL

%"domainname\AWS Delegated Administrators" ALL=(ALL:ALL) ALL

Check the domain name: Ensure that you're using the correct domain name for your directory service. Double-check the spelling and capitalization.

Verify the group membership: Confirm that the user or group you're trying to add to the sudoers list is actually a member of the AWS Delegated Administrators group in your directory service.

Try a different user or group: If the AWS Delegated Administrators group is still not working, you can try adding a different user or group from your directory service to the sudoers list to see if that works.

profile picture
Basel Mohamed
answered 2 months ago

Relevant content