Editing Tornedo.tetrain.com Upgrade Plan (section)

=== 9.3 Two more onboardings (<code><nowiki>zurt-sysnet</nowiki></code>, <code><nowiki>email.rahulchaudhry.com</nowiki></code>) — same hosts-file bug, ===

plus two *new* systemic gaps found

'''<code><nowiki>zurt-sysnet.mysecuremail.email</nowiki></code>''': identical swapped-hostname + loopback <code><nowiki>/etc/hosts</nowiki></code> bug as <code><nowiki>zurt-ison</nowiki></code> (labels reversed: <code><nowiki>sysnet-zurt</nowiki></code> vs. actual <code><nowiki>zurt-sysnet</nowiki></code>) — same fix applied (correct name + real IP <code><nowiki>65.20.85.22</nowiki></code>, <code><nowiki>manage_etc_hosts: false</nowiki></code>).

'''<code><nowiki>email.rahulchaudhry.com</nowiki></code>''' (Ubuntu 25.10) — three separate issues in one onboarding:

# <code><nowiki>ipa-client-install</nowiki></code> failed at the time-sync step: <code><nowiki>chrony.service</nowiki></code> not found — chrony wasn't installed on this image at all, even though the installer tried to configure it. Fixed with <code><nowiki>apt-get install -y chrony</nowiki></code> before retrying. Worth checking chrony is present *before* running <code><nowiki>ipa-client-install</nowiki></code> on future minimal/stripped images.
# <code><nowiki>--mkhomedir</nowiki></code> didn't actually create home directories despite being passed — same Debian/pam-auth-update gap as the <code><nowiki>pam_sss</nowiki></code> one, but for a *different* profile: <code><nowiki>pam_mkhomedir.so</nowiki></code> was missing from <code><nowiki>common-session</nowiki></code>. Fix: <code><nowiki>pam-auth-update --force --enable mkhomedir</nowiki></code> (in addition to <code><nowiki>--enable sss</nowiki></code>, not instead of).
# '''New, distinct finding''': sudo denied for a user (<code><nowiki>biswajit</nowiki></code>) known to have valid, working IPA sudo rules (<code><nowiki>sudorule1</nowiki></code>, Host category: all, confirmed via <code><nowiki>ipa sudorule-show</nowiki></code>) — with zero SSSD sudo-responder log activity for any of it, even after confirming <code><nowiki>libsss-sudo</nowiki></code> was installed, the shared library existed on disk, and the SSSD sudo socket was present and correctly permissioned. Root cause: **Ubuntu 25.10 ships <code><nowiki>sudo-rs</nowiki></code> (a Rust reimplementation of sudo) as the *default* <code><nowiki>/usr/bin/sudo</nowiki></code>**, and this version (<code><nowiki>0.2.8</nowiki></code>) does not appear to support SSSD/IPA-driven sudo rules — it silently falls back to local-file-only sudoers evaluation, giving a plausible-looking (if oddly-worded — custom "I'm sorry, I'm afraid I can't do that" message) denial with no diagnostic trail on the SSSD side at all. Classic GNU sudo (<code><nowiki>1.9.17p2</nowiki></code>) was already installed alongside it, just not the active alternative.

'''Fix''': switch the <code><nowiki>sudo</nowiki></code> alternative to the classic binary (which the <code><nowiki>sudo</nowiki></code> package installs at <code><nowiki>/usr/bin/sudo.ws</nowiki></code> on this Ubuntu convention, not the plain <code><nowiki>/usr/bin/sudo</nowiki></code> path — no <code><nowiki>dpkg-divert</nowiki></code> involved, just an incompletely-registered alternatives group):

<pre>
<nowiki>
   update-alternatives --install /usr/bin/sudo sudo /usr/bin/sudo.ws 50
   update-alternatives --set sudo /usr/bin/sudo.ws
</nowiki>
</pre>

Verified via <code><nowiki>sudo --version</nowiki></code> (no longer reports <code><nowiki>sudo-rs</nowiki></code>) and <code><nowiki>sudo -l -U biswajit</nowiki></code> (correctly returned <code><nowiki>(root) NOPASSWD: ALL</nowiki></code>, matching <code><nowiki>sudorule1</nowiki></code>).

'''Updated action item for Ubuntu 25.10+ onboarding specifically''': in addition to the <code><nowiki>pam-auth-update --force --enable sss</nowiki></code> step, also run <code><nowiki>--enable mkhomedir</nowiki></code>, and check <code><nowiki>sudo --version</nowiki></code> — if it reports <code><nowiki>sudo-rs</nowiki></code>, switch to classic sudo via the <code><nowiki>update-alternatives</nowiki></code> commands above *before* considering the box's sudo access functional for any IPA-managed user.