[Fab-user] using fabric with dzdo

[Michael Mullay]

Hi,

Currently we are running 100% Unix, but will be migrating to Linux.
Currently we are able to run sudo commands for those that already are set
up on the remote hosts as such:

env.sudo_prompt = "Password:"
env.sudo_prefix = "/opt/sfw/bin/sudo -S -p '%(sudo_prompt)s' " % env

And it works fine. However, the Linux servers are authenticating to Active
Directory via Centrify, so we actually have to use their 'dzdo' utility
instead of sudo. Commands I can run from the remote client's cli work, eg:

$ dzdo yum update

But running from fabric, replacing the sudo path with the path to the dzdo
utility and the correct prompt like this:

env.sudo_prompt = "[dzdo] password for xxxxx:"
env.sudo_prefix = "/usr/share/centrifydc/bin/dzdo -S -p '%(sudo_prompt)s' "
% env

I get this response:

Sorry, user xxxxx is not allowed to execute '/bin/bash -l -c yum update'
as root on server.abc

Has anyone got dzdo to work with fabric?

Thanks!

[Brandon Whaley]

Hi Michael, it sounds like your dzdo config limits what commands can
be run (correct me if I'm wrong) and that invoking /bin/bash directly
is not allowed. Have you tried setting env.use_shell=False?

http://docs.fabfile.org/en/1.10/usage/env.html?highlight=use_shell#use-shell

Post by Michael Mullay
Hi,
Currently we are running 100% Unix, but will be migrating to Linux.
Currently we are able to run sudo commands for those that already are set up
env.sudo_prompt = "Password:"
env.sudo_prefix = "/opt/sfw/bin/sudo -S -p '%(sudo_prompt)s' " % env
And it works fine. However, the Linux servers are authenticating to Active
Directory via Centrify, so we actually have to use their 'dzdo' utility
$ dzdo yum update
But running from fabric, replacing the sudo path with the path to the dzdo
env.sudo_prompt = "[dzdo] password for xxxxx:"
env.sudo_prefix = "/usr/share/centrifydc/bin/dzdo -S -p '%(sudo_prompt)s' "
% env
Sorry, user xxxxx is not allowed to execute '/bin/bash -l -c yum update' as
root on server.abc
Has anyone got dzdo to work with fabric?
Thanks!
_______________________________________________
Fab-user mailing list
https://lists.nongnu.org/mailman/listinfo/fab-user

[Michael Mullay]

Brandon,

That was the problem, thanks much for the response!

Cheers

Post by Brandon Whaley
Hi Michael, it sounds like your dzdo config limits what commands can
be run (correct me if I'm wrong) and that invoking /bin/bash directly
is not allowed. Have you tried setting env.use_shell=False?
http://docs.fabfile.org/en/1.10/usage/env.html?highlight=use_shell#use-shell

Post by Michael Mullay
Hi,
Currently we are running 100% Unix, but will be migrating to Linux.
Currently we are able to run sudo commands for those that already are

set up

Post by Michael Mullay
env.sudo_prompt = "Password:"
env.sudo_prefix = "/opt/sfw/bin/sudo -S -p '%(sudo_prompt)s' " % env
And it works fine. However, the Linux servers are authenticating to

Active

Post by Michael Mullay
Directory via Centrify, so we actually have to use their 'dzdo' utility
instead of sudo. Commands I can run from the remote client's cli work,
$ dzdo yum update
But running from fabric, replacing the sudo path with the path to the

dzdo

Post by Michael Mullay
env.sudo_prompt = "[dzdo] password for xxxxx:"
env.sudo_prefix = "/usr/share/centrifydc/bin/dzdo -S -p

'%(sudo_prompt)s' "

Post by Michael Mullay
% env
Sorry, user xxxxx is not allowed to execute '/bin/bash -l -c yum

update' as

Post by Michael Mullay
root on server.abc
Has anyone got dzdo to work with fabric?
Thanks!
_______________________________________________
Fab-user mailing list
https://lists.nongnu.org/mailman/listinfo/fab-user