I keep looking for it in howto/ldap and not finding it. this should
help at least a little.

I didn't move the doc/accounts documentation here because I'm not sure
yet I want to operate this migration, see also #40129

doc/accounts.md

@@ -242,6 +242,7 @@ schedule to all hosts.
 
 There are also delays involved in the mail loop, of course.
 
+<a id="sudo" />
 ### Host specific passwords / sudo passwords ###
 
 Your LDAP password can *not* be used to authenticate to `sudo` on