Skip to content

Fix Kali/Debian join: sudo lockout from libsss-sudo and missing sssd #124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PierreGode merged 1 commit into from
Nov 2, 2026
Merged

Fix Kali/Debian join: sudo lockout from libsss-sudo and missing sssd #124

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 79 additions & 8 deletions ADconnection.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,66 @@
END=$(printf "\033[0m")
# ~~~~~~~~~~ Environment Setup ~~~~~~~~~~ #

# ~~~~~~~~~~ Package helpers (Debian / Kali) ~~~~~~~~~~ #
# Run a command as root without depending on sudo when the script already runs as root
# (sudo itself can break mid-run, see fix_nsswitch_sudoers).
as_root(){
if [ "$(id -u)" -eq 0 ]
then
"$@"
else
sudo "$@"
fi
}

# libsss-sudo from newer sssd releases (2.10+, Debian sid / Kali rolling) appends "sss" to the
# "sudoers:" line in /etc/nsswitch.conf and, when that line is missing (default on Kali and Debian),
# creates "sudoers: sss". That drops sudo's implicit "files" source, so nobody - root included - can
# use sudo any more and every following sudo call fails with "root is not in the sudoers file".
# This script keeps its sudo rules in /etc/sudoers.d, so pin the sudoers source to "files".
# Call it before and after installing libsss-sudo.
fix_nsswitch_sudoers(){
[ -f /etc/nsswitch.conf ] || return 0
if grep -q '^sudoers:' /etc/nsswitch.conf
then
as_root sed -i -e 's/^sudoers:.*/sudoers: files/' /etc/nsswitch.conf
else
echo "sudoers: files" | as_root tee -a /etc/nsswitch.conf > /dev/null
fi
}

# sssd has been dropped from Debian testing, so Kali rolling (and Debian testing) have no sssd package.
# It is still in Debian sid: offer to add sid as a low priority source (pin 100), which is only used for
# packages the distribution itself does not provide.
ensure_sssd_available(){
if apt-cache policy sssd 2>/dev/null | grep -q 'Candidate: [0-9]'
then
return 0
fi
echo "${RED_TEXT}sssd is not available from your apt sources (it has been dropped from Debian testing / Kali rolling).${END}"
echo "It can be installed from Debian sid with a low priority pin, so nothing else is taken from sid."
read -r -p "Add Debian sid as a pinned apt source for sssd (y/n)?" yn
case $yn in
[Yy]* )
as_root apt-get -qq install debian-archive-keyring -y
printf '%s\n' "Types: deb" "URIs: http://deb.debian.org/debian" "Suites: sid" "Components: main" \
"Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg" | as_root tee /etc/apt/sources.list.d/debian-sid-sssd.sources > /dev/null
printf '%s\n' "Package: *" "Pin: release n=sid" "Pin-Priority: 100" | as_root tee /etc/apt/preferences.d/debian-sid-sssd > /dev/null
as_root apt-get -qq update
;;
* )
echo "${RED_TEXT}sssd is required to join the domain, exiting.${END}"
exit 1
;;
esac
if ! apt-cache policy sssd 2>/dev/null | grep -q 'Candidate: [0-9]'
then
echo "${RED_TEXT}sssd is still not available, please check your apt sources and try again.${END}"
exit 1
fi
}
# ~~~~~~~~~~ Package helpers (Debian / Kali) ~~~~~~~~~~ #

####################### final auth ##################################################################
#this section will do the last part, configure sssd, ssh, login session sam files and sudoers#
fi_auth(){
Expand Down Expand Up @@ -208,7 +268,7 @@ clear
sed -i -e 's/fallback_homedir = \/home\/%u@%d/#fallback_homedir = \/home\/%u@%d/g' /etc/sssd/sssd.conf
sed -i -e 's/use_fully_qualified_names = True/use_fully_qualified_names = False/g' /etc/sssd/sssd.conf
sed -i -e 's/access_provider = ad/access_provider = simple/g' /etc/sssd/sssd.conf
sed -i -e 's/sudoers: files sss/sudoers: files/g' /etc/nsswitch.conf
fix_nsswitch_sudoers
echo "override_homedir = /home/%u" | sudo tee -a /etc/sssd/sssd.conf
sudo sudo grep -i override /etc/sssd/sssd.conf
#sudo echo "[nss]
Expand Down Expand Up @@ -563,7 +623,7 @@ clear
sed -i -e 's/fallback_homedir = \/home\/%u@%d/#fallback_homedir = \/home\/%u@%d/g' /etc/sssd/sssd.conf
sed -i -e 's/use_fully_qualified_names = True/use_fully_qualified_names = False/g' /etc/sssd/sssd.conf
sed -i -e 's/access_provider = ad/access_provider = simple/g' /etc/sssd/sssd.conf
sed -i -e 's/sudoers: files sss/sudoers: files/g' /etc/nsswitch.conf
fix_nsswitch_sudoers
echo "override_homedir = /home/%u" | sudo tee -a /etc/sssd/sssd.conf
sudo sudo grep -i override /etc/sssd/sssd.conf
#sudo echo "[nss]
Expand Down Expand Up @@ -1548,7 +1608,7 @@ fi
sed -i -e 's/fallback_homedir = \/home\/%u@%d/#fallback_homedir = \/home\/%u@%d/g' /etc/sssd/sssd.conf
sed -i -e 's/use_fully_qualified_names = True/use_fully_qualified_names = False/g' /etc/sssd/sssd.conf
sed -i -e 's/access_provider = ad/access_provider = simple/g' /etc/sssd/sssd.conf
sed -i -e 's/sudoers: files sss/sudoers: files/g' /etc/nsswitch.conf
fix_nsswitch_sudoers
echo "override_homedir = /home/%u" | sudo tee -a /etc/sssd/sssd.conf
sudo grep -i override /etc/sssd/sssd.conf
#sudo echo "[nss]
Expand Down Expand Up @@ -1576,11 +1636,16 @@ admins=$( grep home /etc/passwd | grep bash | cut -d ':' -f1 )
sudo echo "${RED_TEXT}Installing packages do no abort!.......${END}"
sudo apt install adcli -y
sudo apt-get -qq update
ensure_sssd_available
fix_nsswitch_sudoers
sudo apt-get -qq install libsss-sudo -y
fix_nsswitch_sudoers
sudo apt-get -qq install adcli -y
sudo apt-get -qq install realmd adcli krb5-user sssd -y
sudo apt-get -qq install ntp curl -y
sudo apt-get -qq install policykit-1 -y
sudo apt-get -qq install curl -y
# ntp and policykit-1 are gone from current Kali/Debian, use their replacements
sudo apt-get -qq install ntp -y || sudo apt-get -qq install ntpsec -y
sudo apt-get -qq install policykit-1 -y || sudo apt-get -qq install polkitd -y
sudo mkdir -p /var/lib/samba/private
sudo apt-get -qq install -f -y
clear
Expand Down Expand Up @@ -1735,10 +1800,14 @@ clear
sudo echo "${RED_TEXT}Installing packages do no abort!.......${END}"
sudo apt install adcli -y
sudo apt-get -qq update
ensure_sssd_available
fix_nsswitch_sudoers
sudo apt-get -qq install libsss-sudo -y
fix_nsswitch_sudoers
sudo apt-get -qq install realmd adcli krb5-user sssd curl -y
sudo apt-get -qq install ntp -y
sudo apt-get -qq install policykit-1 -y
# ntp and policykit-1 are gone from current Debian, use their replacements
sudo apt-get -qq install ntp -y || sudo apt-get -qq install ntpsec -y
sudo apt-get -qq install policykit-1 -y || sudo apt-get -qq install polkitd -y
sudo mkdir -p /var/lib/samba/private
sudo apt-get -qq install realmd adcli sssd -y
sudo apt-get -qq install ntp -y
Expand Down Expand Up @@ -1911,7 +1980,9 @@ export HOSTNAME
myhost=$( hostname | cut -d '.' -f1 )
sudo aptitude install ntp adcli sssd krb5-user
sudo mkdir -p /var/lib/samba/private
fix_nsswitch_sudoers
sudo aptitude install libsss-sudo
fix_nsswitch_sudoers
sudo systemctl enable sssd
clear
DOMAIN=$( realm discover | grep -i realm-name | awk '{print $2}')
Expand All @@ -1937,7 +2008,7 @@ sudo echo "%$myhost""sudoers ALL=(ALL) NOPASSWD:ALL" | sudo tee -a /etc/sudoers.
sed -i -e 's/fallback_homedir = \/home\/%u@%d/#fallback_homedir = \/home\/%u@%d/g' /etc/sssd/sssd.conf
sed -i -e 's/use_fully_qualified_names = True/use_fully_qualified_names = False/g' /etc/sssd/sssd.conf
sed -i -e 's/access_provider = ad/access_provider = simple/g' /etc/sssd/sssd.conf
sed -i -e 's/sudoers: files sss/sudoers: files/g' /etc/nsswitch.conf
fix_nsswitch_sudoers
echo "override_homedir = /home/%u" | sudo tee -a /etc/sssd/sssd.conf
sudo grep -i override /etc/sssd/sssd.conf
sudo echo "[nss]
Expand Down
Loading