The Remote Privilege Escalation Check
The System Security Services Daemon (SSSD) is the standard method for connecting an Ubuntu Linux server to a centralized identity provider, such as LDAP or Microsoft Active Directory. SSSD is built using a modular architecture. One of these specialized responder modules is the sssd-sudo.service. This daemon is designed to intercept commands when a user types sudo, and query the central LDAP directory to see if the user has been granted remote privilege escalation rights via LDAP-stored sudo rules.
This is a powerful feature for enterprise environments that centrally manage administrator access across thousands of servers. However, if you are simply using SSSD to allow users to log in, but you manage your sudo permissions locally (by manually editing the /etc/sudoers file or assigning users to the local sudo group), the sssd-sudo responder is completely useless. It will intercept every sudo attempt, query an empty LDAP schema, and then fall back to the local files, introducing a slight delay and wasting memory. It should be disabled.
How to Disable the SSSD Sudo Responder
You can stop this remote authorization module using systemctl.
Warning: Do not disable this if your organization relies on LDAP or FreeIPA to distribute sudo rules to your servers. Doing so will prevent remote administrators from executing privileged commands.
- Open your Ubuntu Terminal or connect via SSH.
- Stop the active service socket (if it is listening):
sudo systemctl stop sssd-sudo.socket- Stop the daemon itself:
sudo systemctl stop sssd-sudo.service- Disable both to prevent them from initializing on the next boot:
sudo systemctl disable sssd-sudo.socket
sudo systemctl disable sssd-sudo.serviceYour server will now rely exclusively on the local /etc/sudoers file for privilege escalation, speeding up the sudo prompt and reducing the footprint of the SSSD framework.