From bb4851428eac4d947a4bc5cef3affc5fba51733e Mon Sep 17 00:00:00 2001
From: PierreGode <pierre@gode.one>
Date: Mon, 2 Nov 2026 20:30:12 +0100
Subject: [PATCH] Fix Kali/Debian join: sudo lockout from libsss-sudo and
 missing sssd

- libsss-sudo from sssd 2.10+ (Debian sid / Kali rolling) writes
  "sudoers: sss" to /etc/nsswitch.conf when no sudoers line exists,
  dropping sudo's implicit "files" source. Every following sudo then
  fails with "root is not in the sudoers file" and the join aborts
  right after the package step. Add fix_nsswitch_sudoers and call it
  before/after installing libsss-sudo and in the final auth steps
  (replaces the exact-match sed that missed this case).
- sssd is not in Kali rolling / Debian testing. ensure_sssd_available
  offers to add Debian sid as a pin-100 apt source for it.
- ntp and policykit-1 no longer exist: fall back to ntpsec and polkitd.
---
 ADconnection.sh | 87 ++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 79 insertions(+), 8 deletions(-)

diff --git a/ADconnection.sh b/ADconnection.sh
index 929355b..7635e9a 100755
--- a/ADconnection.sh
+++ b/ADconnection.sh
@@ -24,6 +24,66 @@
     END=$(printf "\033[0m")
 # ~~~~~~~~~~  Environment Setup ~~~~~~~~~~ #
 
+# ~~~~~~~~~~  Package helpers (Debian / Kali) ~~~~~~~~~~ #
+# Run a command as root without depending on sudo when the script already runs as root
+# (sudo itself can break mid-run, see fix_nsswitch_sudoers).
+as_root(){
+if [ "$(id -u)" -eq 0 ]
+then
+"$@"
+else
+sudo "$@"
+fi
+}
+
+# libsss-sudo from newer sssd releases (2.10+, Debian sid / Kali rolling) appends "sss" to the
+# "sudoers:" line in /etc/nsswitch.conf and, when that line is missing (default on Kali and Debian),
+# creates "sudoers: sss". That drops sudo's implicit "files" source, so nobody - root included - can
+# use sudo any more and every following sudo call fails with "root is not in the sudoers file".
+# This script keeps its sudo rules in /etc/sudoers.d, so pin the sudoers source to "files".
+# Call it before and after installing libsss-sudo.
+fix_nsswitch_sudoers(){
+[ -f /etc/nsswitch.conf ] || return 0
+if grep -q '^sudoers:' /etc/nsswitch.conf
+then
+as_root sed -i -e 's/^sudoers:.*/sudoers:        files/' /etc/nsswitch.conf
+else
+echo "sudoers:        files" | as_root tee -a /etc/nsswitch.conf > /dev/null
+fi
+}
+
+# sssd has been dropped from Debian testing, so Kali rolling (and Debian testing) have no sssd package.
+# It is still in Debian sid: offer to add sid as a low priority source (pin 100), which is only used for
+# packages the distribution itself does not provide.
+ensure_sssd_available(){
+if apt-cache policy sssd 2>/dev/null | grep -q 'Candidate: [0-9]'
+then
+return 0
+fi
+echo "${RED_TEXT}sssd is not available from your apt sources (it has been dropped from Debian testing / Kali rolling).${END}"
+echo "It can be installed from Debian sid with a low priority pin, so nothing else is taken from sid."
+read -r -p "Add Debian sid as a pinned apt source for sssd (y/n)?" yn
+case $yn in
+[Yy]* )
+as_root apt-get -qq install debian-archive-keyring -y
+printf '%s\n' "Types: deb" "URIs: http://deb.debian.org/debian" "Suites: sid" "Components: main" \
+"Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg" | as_root tee /etc/apt/sources.list.d/debian-sid-sssd.sources > /dev/null
+printf '%s\n' "Package: *" "Pin: release n=sid" "Pin-Priority: 100" | as_root tee /etc/apt/preferences.d/debian-sid-sssd > /dev/null
+as_root apt-get -qq update
+;;
+* )
+echo "${RED_TEXT}sssd is required to join the domain, exiting.${END}"
+exit 1
+;;
+esac
+if ! apt-cache policy sssd 2>/dev/null | grep -q 'Candidate: [0-9]'
+then
+echo "${RED_TEXT}sssd is still not available, please check your apt sources and try again.${END}"
+exit 1
+fi
+}
+# ~~~~~~~~~~  Package helpers (Debian / Kali) ~~~~~~~~~~ #
+
 ####################### final auth ##################################################################
 #this section will do the last part, configure sssd, ssh, login session sam files and sudoers#
 fi_auth(){
@@ -208,7 +268,7 @@ clear
 sed -i -e 's/fallback_homedir = \/home\/%u@%d/#fallback_homedir = \/home\/%u@%d/g' /etc/sssd/sssd.conf
 sed -i -e 's/use_fully_qualified_names = True/use_fully_qualified_names = False/g' /etc/sssd/sssd.conf
 sed -i -e 's/access_provider = ad/access_provider = simple/g' /etc/sssd/sssd.conf
-sed -i -e 's/sudoers:        files sss/sudoers:        files/g' /etc/nsswitch.conf
+fix_nsswitch_sudoers
 echo "override_homedir = /home/%u" | sudo tee -a /etc/sssd/sssd.conf
 sudo sudo grep -i override /etc/sssd/sssd.conf
 #sudo echo "[nss]
@@ -563,7 +623,7 @@ clear
 sed -i -e 's/fallback_homedir = \/home\/%u@%d/#fallback_homedir = \/home\/%u@%d/g' /etc/sssd/sssd.conf
 sed -i -e 's/use_fully_qualified_names = True/use_fully_qualified_names = False/g' /etc/sssd/sssd.conf
 sed -i -e 's/access_provider = ad/access_provider = simple/g' /etc/sssd/sssd.conf
-sed -i -e 's/sudoers:        files sss/sudoers:        files/g' /etc/nsswitch.conf
+fix_nsswitch_sudoers
 echo "override_homedir = /home/%u" | sudo tee -a /etc/sssd/sssd.conf
 sudo sudo grep -i override /etc/sssd/sssd.conf
 #sudo echo "[nss]
@@ -1548,7 +1608,7 @@ fi
 sed -i -e 's/fallback_homedir = \/home\/%u@%d/#fallback_homedir = \/home\/%u@%d/g' /etc/sssd/sssd.conf
 sed -i -e 's/use_fully_qualified_names = True/use_fully_qualified_names = False/g' /etc/sssd/sssd.conf
 sed -i -e 's/access_provider = ad/access_provider = simple/g' /etc/sssd/sssd.conf
-sed -i -e 's/sudoers:        files sss/sudoers:        files/g' /etc/nsswitch.conf
+fix_nsswitch_sudoers
 echo "override_homedir = /home/%u" | sudo tee -a /etc/sssd/sssd.conf
 sudo grep -i override /etc/sssd/sssd.conf
 #sudo echo "[nss]
@@ -1576,11 +1636,16 @@ admins=$( grep home /etc/passwd | grep bash | cut -d ':' -f1 )
 sudo echo "${RED_TEXT}Installing packages do no abort!.......${END}"
 sudo apt install adcli -y
 sudo apt-get -qq update
+ensure_sssd_available
+fix_nsswitch_sudoers
 sudo apt-get -qq install libsss-sudo -y
+fix_nsswitch_sudoers
 sudo apt-get -qq install adcli -y
 sudo apt-get -qq install realmd adcli krb5-user sssd -y
-sudo apt-get -qq install ntp curl -y
-sudo apt-get -qq install policykit-1 -y
+sudo apt-get -qq install curl -y
+# ntp and policykit-1 are gone from current Kali/Debian, use their replacements
+sudo apt-get -qq install ntp -y || sudo apt-get -qq install ntpsec -y
+sudo apt-get -qq install policykit-1 -y || sudo apt-get -qq install polkitd -y
 sudo mkdir -p /var/lib/samba/private
 sudo apt-get -qq install -f -y
 clear
@@ -1735,10 +1800,14 @@ clear
 sudo echo "${RED_TEXT}Installing packages do no abort!.......${END}"
 sudo apt install adcli -y
 sudo apt-get -qq update
+ensure_sssd_available
+fix_nsswitch_sudoers
 sudo apt-get -qq install libsss-sudo -y
+fix_nsswitch_sudoers
 sudo apt-get -qq install realmd adcli krb5-user sssd curl -y
-sudo apt-get -qq install ntp -y
-sudo apt-get -qq install policykit-1 -y
+# ntp and policykit-1 are gone from current Debian, use their replacements
+sudo apt-get -qq install ntp -y || sudo apt-get -qq install ntpsec -y
+sudo apt-get -qq install policykit-1 -y || sudo apt-get -qq install polkitd -y
 sudo mkdir -p /var/lib/samba/private
 sudo apt-get -qq install realmd adcli sssd -y
 sudo apt-get -qq install ntp -y
@@ -1911,7 +1980,9 @@ export HOSTNAME
 myhost=$( hostname | cut -d '.' -f1 )
 sudo aptitude install ntp adcli sssd krb5-user
 sudo mkdir -p /var/lib/samba/private
+fix_nsswitch_sudoers
 sudo aptitude install libsss-sudo
+fix_nsswitch_sudoers
 sudo systemctl enable sssd
 clear
 DOMAIN=$( realm discover | grep -i realm-name | awk '{print $2}')
@@ -1937,7 +2008,7 @@ sudo echo "%$myhost""sudoers ALL=(ALL) NOPASSWD:ALL" | sudo tee -a /etc/sudoers.
 sed -i -e 's/fallback_homedir = \/home\/%u@%d/#fallback_homedir = \/home\/%u@%d/g' /etc/sssd/sssd.conf
 sed -i -e 's/use_fully_qualified_names = True/use_fully_qualified_names = False/g' /etc/sssd/sssd.conf
 sed -i -e 's/access_provider = ad/access_provider = simple/g' /etc/sssd/sssd.conf
-sed -i -e 's/sudoers:        files sss/sudoers:        files/g' /etc/nsswitch.conf
+fix_nsswitch_sudoers
 echo "override_homedir = /home/%u" | sudo tee -a /etc/sssd/sssd.conf
 sudo grep -i override /etc/sssd/sssd.conf
 sudo echo "[nss]