[PierreGode]

Problem

Running ADconnection.sh on current Kali rolling (2026.2, arm64) fails before realm join:

1. sudo lockout. libsss-sudo from sssd 2.10+ (Debian sid) creates sudoers: sss in /etc/nsswitch.conf when no sudoers: line exists (Kali and Debian ship without one). That drops sudo's implicit files source, so every following sudo in the script fails with root is not in the sudoers file. The existing sed 's/sudoers: files sss/.../' only matches the exact old format and runs too late, in the final auth step.
2. sssd missing. sssd has been dropped from Debian testing, so Kali rolling has no sssd/libsss-sudo package at all. It is still in Debian sid (2.13.1).
3. ntp and policykit-1 have no installation candidate any more.

Fix

• fix_nsswitch_sudoers: pins the sudoers source to files (the script keeps its rules in /etc/sudoers.d). It is called before and after installing libsss-sudo (kalijoin, debianclient, raspberry) and replaces the exact-match sed in the final auth functions. It runs through a new as_root helper that doesn't need sudo when the script already runs as root.
• ensure_sssd_available: if sssd has no apt candidate, offers to add Debian sid as a pin-100 source, so only packages the distro lacks (sssd) come from sid. Called in kalijoin and debianclient.
• Falls back ntp → ntpsec and policykit-1 → polkitd.

Testing

• bash -n passes.
• fix_nsswitch_sudoers unit-tested on temp files with no line, sudoers: sss, sudoers: files sss and sudoers: files: each ends with exactly one sudoers: files line and is idempotent.
• Reproduced issues 1–3 on a Kali rolling Pi against a Samba AD DC (gode.lan). A dry run of the sid pin pulled only the sssd packages from sid, with no removals.
• Not yet verified end to end: the patched script has not been run through the full realm join and final auth on Kali yet.