All,
Recently you helped me get nrpe installed on a Red Hat 8 client. First, my installation doesn't allow the install script to pull down rpm's, pip's etc. I am required to pull them down to my desktop, then run software against it to see if it contains malicious software. Then I manually deploy the software. The install script did not install the nrpe agent and Nagios helped me get the software installed. The problem is that services requiring sudo permissions (cron, open files, ssl server) do not work. Services not requiring sudo permissions do work. I get a NRPE: Unable to read output error message. I have reviewed the code found on the Red Hat 8 client against code on a RedHat 7 client. Both code and permissions are the same. I have also searched /var/log hoping to find more of an explanation as to what is happening without success. Any suggestions to rectify this matter will be greatly appreciated. Thank you.
Nagios xi services requiring sudo permissions don't work
-
HIINNS
- Posts: 172
- Joined: Wed Mar 14, 2018 9:43 am
-
vtrac
- Posts: 903
- Joined: Tue Oct 27, 2020 1:35 pm
Re: Nagios xi services requiring sudo permissions don't work
Hi,
Hope you are having a good day!! ...
Can you please post the error(s) and the command(s) used? ... or screenshots
Please upload the "sudoers" file belong to both your Nagios xi and your NRPE remote agent machines:
Also, please share or upload the "nrpe.cfg" file belong to your NRPE remote agent:
Best Regards,
Vinh
Hope you are having a good day!! ...
Can you please post the error(s) and the command(s) used? ... or screenshots
Please upload the "sudoers" file belong to both your Nagios xi and your NRPE remote agent machines:
Code: Select all
/etc/sudoersCode: Select all
/usr/local/nagios/etc/nrpe.cfgBest Regards,
Vinh
-
HIINNS
- Posts: 172
- Joined: Wed Mar 14, 2018 9:43 am
Re: Nagios xi services requiring sudo permissions don't work
Unfortunately, I am unable to upload the /etc/sudoers file as it contains proprietary information not allowed outside the company.
On the Nagios xi server I have sudo all permissions.
On all nagios xi clients I have the following sudo's :
/bin/cat *, \
/bin/cp /tmp/fprobe /etc/init.d/,
/bin/cp /tmp/* /usr/lib/nagios/plugins, \
/bin/cp /tmp/* /usr/local/nagios/libexec, \
/bin/kill *, \
/etc/init.d/nagios *, \
/etc/init.d/ndo2db *, \
/etc/init.d/npcd *, \
/etc/init.d/rc.tc.jmx_proxy *, \
/sbin/ldconfig, \
/sbin/service nrpe restart, \
/sbin/service xinetd restart, \
/tc/tcsoftware/Nagios/fprobeinstall.sh, \
/tc/tcsoftware/Nagios/fullinstall, \
/tmp/Nagios/fullinstall, \
/tmp/nagioslogserver/fullinstall, \
/usr/bin/cat *, \
/usr/bin/chmod 666 /usr/local/nagvis/share/userfiles/images/maps/*.png, \
/usr/bin/kill `cat /var/run/mysqld/mysqld.pid`, \
/usr/bin/kill `/var/run/mariadb/mariadb.pid`, \
/usr/bin/ls * , \
/usr/bin/more *, \
/usr/bin/mysqld_safe --skip-grant-tables --skip-networking & , \
/usr/bin/php /usr/local/nagiosxi/html/includes/components/autodiscovery/scripts/autodiscover_new.php * , \
/usr/bin/systemctl start mariadb, \
/usr/bin/systemctl start mysql , \
/usr/bin/systemctl stop mariadb, \
/usr/bin/systemctl stop mysql, \
/usr/bin/tail -f /var/log/messages, \
/usr/bin/vi /etc/nagios/nrpe.cfg, \
/usr/bin/vi /etc/xinetd.d/nrpe, \
/usr/bin/vi /etc/yum.repos.d/rhel-7-on-site.repo, \
/usr/bin/vi /etc/nrpe.d/sles_commands.cfg, \
/usr/bin/vi /usr/local/nagios/etc/nrpe/common.cfg, \
/usr/bin/vi /usr/local/nagios/etc/services/*.cfg, \
/usr/bin/vi /usr/local/nagios/libexec/Teamcenter/config.properties, \
/usr/local/bin/nagpass.sh *, \
/usr/local/nagios/libexec/check_init_service, \
/usr/local/nagios/libexec/check_init_service -a 'cron' , \
/usr/local/nagios/libexec/check_init_service -a 'sshd' , \
/usr/local/nagioslogserver/scripts/*, \
/usr/local/nagioslogserver/scripts/*, \
/usr/local/nagiosxi/html/includes/components/profile/getprofile.sh, \
/usr/local/nagiosxi/scripts/*, \
/usr/sbin/fprobe -i *, \
/bin/chmod 644 /usr/local/nagios/etc/nrpe.cfg, \
/usr/bin/chmod 644 /usr/local/nagios/etc/nrpe.cfg, \
/bin/chmod -R 755 /usr/local/nagios, \
/usr/bin/chmod -R 755 /usr/local/nagios,\
/bin/vi /etc/nagios/nrpe.cfg, \
/bin/chmod 755 /usr/lib/nagios/plugins/*, \
/usr/bin/chmod 755 /usr/lib/nagios/plugins/*, \
/usr/local/nagios/bin/nrpe-uninstall *, \
/bin/chmod 755 /usr/local/nagios/*, \
/tc/tcsoftware/Nagios/fullinstall , \
/etc/init.d/nagios checkconfig , \
/usr/bin/php , \
/usr/local/nagiosxi/scripts/components/autodiscover_new.php *, \
/usr/bin/php /usr/local/nagiosxi/scripts/send_to_nls.php * , \
/usr/bin/php /usr/local/nagiosxi/scripts/migrate/migrate.php * , \
/usr/local/nagiosxi/scripts/components/getprofile.sh , \
/usr/local/nagiosxi/scripts/reset_config_perms.sh , \
/usr/local/nagiosxi/scripts/manage_ssl_config.sh * , \
/usr/local/nagiosxi/scripts/backup_xi.sh * , \
/usr/bin/view *
The reason for this is that my installation has a common /etc/sudoers file for both the Nagios xi server and clients. The install script is modified to not modify the /etc/sudoers file.
/usr/local/nagios/etc/nrpe.cfg ->
cat nrpe.cfg
#############################################################################
# Sample NRPE Config File
# Written by: Ethan Galstad (nagios@nagios.org)
#
# Last Modified: 11-23-2007
#
# NOTES:
# This is a sample configuration file for the NRPE daemon. It needs to be
# located on the remote host that is running the NRPE daemon, not the host
# from which the check_nrpe client is being executed.
#############################################################################
# LOG FACILITY
# The syslog facility that should be used for logging purposes.
log_facility=daemon
# PID FILE
# The name of the file in which the NRPE daemon should write it's process ID
# number. The file is only written if the NRPE daemon is started by the root
# user and is running in standalone mode.
pid_file=/var/run/nrpe/nrpe.pid
# PORT NUMBER
# Port number we should wait for connections on.
# NOTE: This must be a non-priviledged port (i.e. > 1024).
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
server_port=5666
# SERVER ADDRESS
# Address that nrpe should bind to in case there are more than one interface
# and you do not want nrpe to bind on all interfaces.
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
#server_address=127.0.0.1
# NRPE USER
# This determines the effective user that the NRPE daemon should run as.
# You can either supply a username or a UID.
#
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
nrpe_user=nagios
# NRPE GROUP
# This determines the effective group that the NRPE daemon should run as.
# You can either supply a group name or a GID.
#
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
nrpe_group=nagios
# ALLOWED HOST ADDRESSES
# This is an optional comma-delimited list of IP address or hostnames
# that are allowed to talk to the NRPE daemon.
#
# Note: The daemon only does rudimentary checking of the client's IP
# address. I would highly recommend adding entries in your /etc/hosts.allow
# file to allow only the specified host to connect to the port
# you are running this daemon on.
#
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
allowed_hosts=127.0.0.1
# COMMAND ARGUMENT PROCESSING
# This option determines whether or not the NRPE daemon will allow clients
# to specify arguments to commands that are executed. This option only works
# if the daemon was configured with the --enable-command-args configure script
# option.
#
# *** ENABLING THIS OPTION IS A SECURITY RISK! ***
# Read the SECURITY file for information on some of the security implications
# of enabling this variable.
#
# Values: 0=do not allow arguments, 1=allow command arguments
dont_blame_nrpe=1
# COMMAND PREFIX
# This option allows you to prefix all commands with a user-defined string.
# A space is automatically added between the specified prefix string and the
# command line from the command definition.
#
# *** THIS EXAMPLE MAY POSE A POTENTIAL SECURITY RISK, SO USE WITH CAUTION! ***
# Usage scenario:
# Execute restricted commmands using sudo. For this to work, you need to add
# the nagios user to your /etc/sudoers. An example entry for alllowing
# execution of the plugins from might be:
#
# nagios ALL=(ALL) NOPASSWD: /usr/lib/nagios/plugins/
#
# This lets the nagios user run all commands in that directory (and only them)
# without asking for a password. If you do this, make sure you don't give
# random users write access to that directory or its contents!
# command_prefix=/usr/bin/sudo
# DEBUGGING OPTION
# This option determines whether or not debugging messages are logged to the
# syslog facility.
# Values: 0=debugging off, 1=debugging on
debug=0
# COMMAND TIMEOUT
# This specifies the maximum number of seconds that the NRPE daemon will
# allow plugins to finish executing before killing them off.
command_timeout=60
# CONNECTION TIMEOUT
# This specifies the maximum number of seconds that the NRPE daemon will
# wait for a connection to be established before exiting. This is sometimes
# seen where a network problem stops the SSL being established even though
# all network sessions are connected. This causes the nrpe daemons to
# accumulate, eating system resources. Do not set this too low.
connection_timeout=300
# WEEK RANDOM SEED OPTION
# This directive allows you to use SSL even if your system does not have
# a /dev/random or /dev/urandom (on purpose or because the necessary patches
# were not applied). The random number generator will be seeded from a file
# which is either a file pointed to by the environment valiable $RANDFILE
# or $HOME/.rnd. If neither exists, the pseudo random number generator will
# be initialized and a warning will be issued.
# Values: 0=only seed from /dev/random, 1=also seed from weak randomness
#allow_weak_random_seed=1
# INCLUDE CONFIG FILE
# This directive allows you to include definitions from an external config file.
#include=<somefile.cfg>
# INCLUDE CONFIG DIRECTORY
# This directive allows you to include definitions from config files (with a
# .cfg extension) in one or more directories (with recursion).
#include_dir=<somedirectory>
include_dir=/usr/local/nagios/etc/nrpe
# COMMAND DEFINITIONS
# Command definitions that this daemon will run. Definitions
# are in the following format:
#
# command[<command_name>]=<command_line>
#
# When the daemon receives a request to return the results of <command_name>
# it will execute the command specified by the <command_line> argument.
#
# Unlike Nagios, the command line cannot contain macros - it must be
# typed exactly as it should be executed.
#
# Note: Any plugins that are used in the command lines must reside
# on the machine that this daemon is running on! The examples below
# assume that you have plugins installed in a /usr/local/nagios/libexec
# directory. Also note that you will have to modify the definitions below
# to match the argument format the plugins expect. Remember, these are
# examples only!
# The following examples use hardcoded command arguments...
#command[check_users]=/usr/local/nagios/libexec/check_users -w 5 -c 10
#command[check_load]=/usr/local/nagios/libexec/check_load -w 15,10,5 -c 30,25,20
#command[check_hda1]=/usr/local/nagios/libexec/check_disk -w 20% -c 10% -p /dev/hda1
#command[check_zombie_procs]=/usr/local/nagios/libexec/check_procs -w 5 -c 10 -s Z
#command[check_total_procs]=/usr/local/nagios/libexec/check_procs -w 150 -c 200
# The following examples allow user-supplied arguments and can
# only be used if the NRPE daemon was compiled with support for
# command arguments *AND* the dont_blame_nrpe directive in this
# config file is set to '1'. This poses a potential security risk, so
# make sure you read the SECURITY file before doing this.
#command[check_users]=/usr/local/nagios/libexec/check_users -w $ARG1$ -c $ARG2$
#command[check_load]=/usr/local/nagios/libexec/check_load -w $ARG1$ -c $ARG2$
#command[check_disk]=/usr/local/nagios/libexec/check_disk -w $ARG1$ -c $ARG2$ -p $ARG3$
#command[check_procs]=/usr/local/nagios/libexec/check_procs -w $ARG1$ -c $ARG2$ -s $ARG3$
On the Nagios xi server I have sudo all permissions.
On all nagios xi clients I have the following sudo's :
/bin/cat *, \
/bin/cp /tmp/fprobe /etc/init.d/,
/bin/cp /tmp/* /usr/lib/nagios/plugins, \
/bin/cp /tmp/* /usr/local/nagios/libexec, \
/bin/kill *, \
/etc/init.d/nagios *, \
/etc/init.d/ndo2db *, \
/etc/init.d/npcd *, \
/etc/init.d/rc.tc.jmx_proxy *, \
/sbin/ldconfig, \
/sbin/service nrpe restart, \
/sbin/service xinetd restart, \
/tc/tcsoftware/Nagios/fprobeinstall.sh, \
/tc/tcsoftware/Nagios/fullinstall, \
/tmp/Nagios/fullinstall, \
/tmp/nagioslogserver/fullinstall, \
/usr/bin/cat *, \
/usr/bin/chmod 666 /usr/local/nagvis/share/userfiles/images/maps/*.png, \
/usr/bin/kill `cat /var/run/mysqld/mysqld.pid`, \
/usr/bin/kill `/var/run/mariadb/mariadb.pid`, \
/usr/bin/ls * , \
/usr/bin/more *, \
/usr/bin/mysqld_safe --skip-grant-tables --skip-networking & , \
/usr/bin/php /usr/local/nagiosxi/html/includes/components/autodiscovery/scripts/autodiscover_new.php * , \
/usr/bin/systemctl start mariadb, \
/usr/bin/systemctl start mysql , \
/usr/bin/systemctl stop mariadb, \
/usr/bin/systemctl stop mysql, \
/usr/bin/tail -f /var/log/messages, \
/usr/bin/vi /etc/nagios/nrpe.cfg, \
/usr/bin/vi /etc/xinetd.d/nrpe, \
/usr/bin/vi /etc/yum.repos.d/rhel-7-on-site.repo, \
/usr/bin/vi /etc/nrpe.d/sles_commands.cfg, \
/usr/bin/vi /usr/local/nagios/etc/nrpe/common.cfg, \
/usr/bin/vi /usr/local/nagios/etc/services/*.cfg, \
/usr/bin/vi /usr/local/nagios/libexec/Teamcenter/config.properties, \
/usr/local/bin/nagpass.sh *, \
/usr/local/nagios/libexec/check_init_service, \
/usr/local/nagios/libexec/check_init_service -a 'cron' , \
/usr/local/nagios/libexec/check_init_service -a 'sshd' , \
/usr/local/nagioslogserver/scripts/*, \
/usr/local/nagioslogserver/scripts/*, \
/usr/local/nagiosxi/html/includes/components/profile/getprofile.sh, \
/usr/local/nagiosxi/scripts/*, \
/usr/sbin/fprobe -i *, \
/bin/chmod 644 /usr/local/nagios/etc/nrpe.cfg, \
/usr/bin/chmod 644 /usr/local/nagios/etc/nrpe.cfg, \
/bin/chmod -R 755 /usr/local/nagios, \
/usr/bin/chmod -R 755 /usr/local/nagios,\
/bin/vi /etc/nagios/nrpe.cfg, \
/bin/chmod 755 /usr/lib/nagios/plugins/*, \
/usr/bin/chmod 755 /usr/lib/nagios/plugins/*, \
/usr/local/nagios/bin/nrpe-uninstall *, \
/bin/chmod 755 /usr/local/nagios/*, \
/tc/tcsoftware/Nagios/fullinstall , \
/etc/init.d/nagios checkconfig , \
/usr/bin/php , \
/usr/local/nagiosxi/scripts/components/autodiscover_new.php *, \
/usr/bin/php /usr/local/nagiosxi/scripts/send_to_nls.php * , \
/usr/bin/php /usr/local/nagiosxi/scripts/migrate/migrate.php * , \
/usr/local/nagiosxi/scripts/components/getprofile.sh , \
/usr/local/nagiosxi/scripts/reset_config_perms.sh , \
/usr/local/nagiosxi/scripts/manage_ssl_config.sh * , \
/usr/local/nagiosxi/scripts/backup_xi.sh * , \
/usr/bin/view *
The reason for this is that my installation has a common /etc/sudoers file for both the Nagios xi server and clients. The install script is modified to not modify the /etc/sudoers file.
/usr/local/nagios/etc/nrpe.cfg ->
cat nrpe.cfg
#############################################################################
# Sample NRPE Config File
# Written by: Ethan Galstad (nagios@nagios.org)
#
# Last Modified: 11-23-2007
#
# NOTES:
# This is a sample configuration file for the NRPE daemon. It needs to be
# located on the remote host that is running the NRPE daemon, not the host
# from which the check_nrpe client is being executed.
#############################################################################
# LOG FACILITY
# The syslog facility that should be used for logging purposes.
log_facility=daemon
# PID FILE
# The name of the file in which the NRPE daemon should write it's process ID
# number. The file is only written if the NRPE daemon is started by the root
# user and is running in standalone mode.
pid_file=/var/run/nrpe/nrpe.pid
# PORT NUMBER
# Port number we should wait for connections on.
# NOTE: This must be a non-priviledged port (i.e. > 1024).
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
server_port=5666
# SERVER ADDRESS
# Address that nrpe should bind to in case there are more than one interface
# and you do not want nrpe to bind on all interfaces.
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
#server_address=127.0.0.1
# NRPE USER
# This determines the effective user that the NRPE daemon should run as.
# You can either supply a username or a UID.
#
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
nrpe_user=nagios
# NRPE GROUP
# This determines the effective group that the NRPE daemon should run as.
# You can either supply a group name or a GID.
#
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
nrpe_group=nagios
# ALLOWED HOST ADDRESSES
# This is an optional comma-delimited list of IP address or hostnames
# that are allowed to talk to the NRPE daemon.
#
# Note: The daemon only does rudimentary checking of the client's IP
# address. I would highly recommend adding entries in your /etc/hosts.allow
# file to allow only the specified host to connect to the port
# you are running this daemon on.
#
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
allowed_hosts=127.0.0.1
# COMMAND ARGUMENT PROCESSING
# This option determines whether or not the NRPE daemon will allow clients
# to specify arguments to commands that are executed. This option only works
# if the daemon was configured with the --enable-command-args configure script
# option.
#
# *** ENABLING THIS OPTION IS A SECURITY RISK! ***
# Read the SECURITY file for information on some of the security implications
# of enabling this variable.
#
# Values: 0=do not allow arguments, 1=allow command arguments
dont_blame_nrpe=1
# COMMAND PREFIX
# This option allows you to prefix all commands with a user-defined string.
# A space is automatically added between the specified prefix string and the
# command line from the command definition.
#
# *** THIS EXAMPLE MAY POSE A POTENTIAL SECURITY RISK, SO USE WITH CAUTION! ***
# Usage scenario:
# Execute restricted commmands using sudo. For this to work, you need to add
# the nagios user to your /etc/sudoers. An example entry for alllowing
# execution of the plugins from might be:
#
# nagios ALL=(ALL) NOPASSWD: /usr/lib/nagios/plugins/
#
# This lets the nagios user run all commands in that directory (and only them)
# without asking for a password. If you do this, make sure you don't give
# random users write access to that directory or its contents!
# command_prefix=/usr/bin/sudo
# DEBUGGING OPTION
# This option determines whether or not debugging messages are logged to the
# syslog facility.
# Values: 0=debugging off, 1=debugging on
debug=0
# COMMAND TIMEOUT
# This specifies the maximum number of seconds that the NRPE daemon will
# allow plugins to finish executing before killing them off.
command_timeout=60
# CONNECTION TIMEOUT
# This specifies the maximum number of seconds that the NRPE daemon will
# wait for a connection to be established before exiting. This is sometimes
# seen where a network problem stops the SSL being established even though
# all network sessions are connected. This causes the nrpe daemons to
# accumulate, eating system resources. Do not set this too low.
connection_timeout=300
# WEEK RANDOM SEED OPTION
# This directive allows you to use SSL even if your system does not have
# a /dev/random or /dev/urandom (on purpose or because the necessary patches
# were not applied). The random number generator will be seeded from a file
# which is either a file pointed to by the environment valiable $RANDFILE
# or $HOME/.rnd. If neither exists, the pseudo random number generator will
# be initialized and a warning will be issued.
# Values: 0=only seed from /dev/random, 1=also seed from weak randomness
#allow_weak_random_seed=1
# INCLUDE CONFIG FILE
# This directive allows you to include definitions from an external config file.
#include=<somefile.cfg>
# INCLUDE CONFIG DIRECTORY
# This directive allows you to include definitions from config files (with a
# .cfg extension) in one or more directories (with recursion).
#include_dir=<somedirectory>
include_dir=/usr/local/nagios/etc/nrpe
# COMMAND DEFINITIONS
# Command definitions that this daemon will run. Definitions
# are in the following format:
#
# command[<command_name>]=<command_line>
#
# When the daemon receives a request to return the results of <command_name>
# it will execute the command specified by the <command_line> argument.
#
# Unlike Nagios, the command line cannot contain macros - it must be
# typed exactly as it should be executed.
#
# Note: Any plugins that are used in the command lines must reside
# on the machine that this daemon is running on! The examples below
# assume that you have plugins installed in a /usr/local/nagios/libexec
# directory. Also note that you will have to modify the definitions below
# to match the argument format the plugins expect. Remember, these are
# examples only!
# The following examples use hardcoded command arguments...
#command[check_users]=/usr/local/nagios/libexec/check_users -w 5 -c 10
#command[check_load]=/usr/local/nagios/libexec/check_load -w 15,10,5 -c 30,25,20
#command[check_hda1]=/usr/local/nagios/libexec/check_disk -w 20% -c 10% -p /dev/hda1
#command[check_zombie_procs]=/usr/local/nagios/libexec/check_procs -w 5 -c 10 -s Z
#command[check_total_procs]=/usr/local/nagios/libexec/check_procs -w 150 -c 200
# The following examples allow user-supplied arguments and can
# only be used if the NRPE daemon was compiled with support for
# command arguments *AND* the dont_blame_nrpe directive in this
# config file is set to '1'. This poses a potential security risk, so
# make sure you read the SECURITY file before doing this.
#command[check_users]=/usr/local/nagios/libexec/check_users -w $ARG1$ -c $ARG2$
#command[check_load]=/usr/local/nagios/libexec/check_load -w $ARG1$ -c $ARG2$
#command[check_disk]=/usr/local/nagios/libexec/check_disk -w $ARG1$ -c $ARG2$ -p $ARG3$
#command[check_procs]=/usr/local/nagios/libexec/check_procs -w $ARG1$ -c $ARG2$ -s $ARG3$
-
vtrac
- Posts: 903
- Joined: Tue Oct 27, 2020 1:35 pm
Re: Nagios xi services requiring sudo permissions don't work
Hi,
Can you please post the error(s) and the command(s) used?
Thanks
Vinh
Can you please post the error(s) and the command(s) used?
Thanks
Vinh
-
HIINNS
- Posts: 172
- Joined: Wed Mar 14, 2018 9:43 am
Re: Nagios xi services requiring sudo permissions don't work
/usr/local/nagios/libexec/check_nrpe -H <Red Hat 8 client> -t 30 -c check_init_service -a 'crond'
NRPE: Unable to read output
/usr/local/nagios/libexec/check_nrpe -H <Red Hat 8 client> -t 30 -c check_open_files -a '-w 250 -c 350'
NRPE: Unable to read output
/usr/local/nagios/libexec/check_nrpe -H <Red Hat 8 client> -t 30 -c check_init_service -a 'sshd'
NRPE: Unable to read output
Sorry for the edits above, My installation doesn't allow server names outside the company.
NRPE: Unable to read output
/usr/local/nagios/libexec/check_nrpe -H <Red Hat 8 client> -t 30 -c check_open_files -a '-w 250 -c 350'
NRPE: Unable to read output
/usr/local/nagios/libexec/check_nrpe -H <Red Hat 8 client> -t 30 -c check_init_service -a 'sshd'
NRPE: Unable to read output
Sorry for the edits above, My installation doesn't allow server names outside the company.
-
vtrac
- Posts: 903
- Joined: Tue Oct 27, 2020 1:35 pm
Re: Nagios xi services requiring sudo permissions don't work
Hi,
How are you doing?
Please edit your "/etc/sudoers" and make sure your "sudoers" files has all the below info.
NOTE, you must be "root" and use the "visudo" command to be able to edit the "sudoer" file.
Best Regards,
Vinh
How are you doing?
Please edit your "/etc/sudoers" and make sure your "sudoers" files has all the below info.
NOTE, you must be "root" and use the "visudo" command to be able to edit the "sudoer" file.
Code: Select all
## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
##
## This file must be edited with the 'visudo' command.
## Host Aliases
## Groups of machines. You may prefer to use hostnames (perhaps using
## wildcards for entire domains) or IP addresses instead.
# Host_Alias FILESERVERS = fs1, fs2
# Host_Alias MAILSERVERS = smtp, smtp2
## User Aliases
## These aren't often necessary, as you can use regular groups
## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname
## rather than USERALIAS
# User_Alias ADMINS = jsmith, mikem
## Command Aliases
## These are groups of related commands...
## Networking
# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
## Installation and management of software
# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
## Services
# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable
## Updating the locate database
# Cmnd_Alias LOCATE = /usr/bin/updatedb
## Storage
# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
## Delegating permissions
# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp
## Processes
# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
## Drivers
# Cmnd_Alias DRIVERS = /sbin/modprobe
# Defaults specification
#
# Refuse to run if unable to disable echo on the tty.
#
Defaults !visiblepw
#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files. Note that HOME
# is already set when the the env_reset option is enabled, so
# this option is only effective for configurations where either
# env_reset is disabled or HOME is present in the env_keep list.
#
Defaults always_set_home
Defaults match_group_by_gid
# Prior to version 1.8.15, groups listed in sudoers that were not
# found in the system group database were passed to the group
# plugin, if any. Starting with 1.8.15, only groups of the form
# %:group are resolved via the group plugin by default.
# We enable always_query_group_plugin to restore old behavior.
# Disable this option for new behavior.
Defaults always_query_group_plugin
Defaults env_reset
Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
#
# Adding HOME to env_keep may enable a user to run unrestricted
# commands via sudo.
#
# Defaults env_keep += "HOME"
Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin
## Next comes the main part: which users can run what software on
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## user MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root ALL=(ALL) ALL
## Allows members of the 'sys' group to run networking, software,
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
## Allows people in group wheel to run all commands
%wheel ALL=(ALL) ALL
## Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL
## Allows members of the users group to mount and unmount the
## cdrom as root
# %users ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
## Allows members of the users group to shutdown this system
# %users localhost=/sbin/shutdown -h now
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
User_Alias NAGIOSxi=nagios
User_Alias NAGIOSxiWEB=apache
NAGIOSxi ALL = NOPASSWD:/etc/init.d/nagios start
NAGIOSxi ALL = NOPASSWD:/etc/init.d/nagios stop
NAGIOSxi ALL = NOPASSWD:/etc/init.d/nagios restart
NAGIOSxi ALL = NOPASSWD:/etc/init.d/nagios reload
NAGIOSxi ALL = NOPASSWD:/etc/init.d/nagios status
NAGIOSxi ALL = NOPASSWD:/etc/init.d/nagios checkconfig
NAGIOSxi ALL = NOPASSWD:/etc/init.d/npcd start
NAGIOSxi ALL = NOPASSWD:/etc/init.d/npcd stop
NAGIOSxi ALL = NOPASSWD:/etc/init.d/npcd restart
NAGIOSxi ALL = NOPASSWD:/etc/init.d/npcd reload
NAGIOSxi ALL = NOPASSWD:/etc/init.d/npcd status
NAGIOSxi ALL = NOPASSWD:/usr/bin/php /usr/local/nagiosxi/scripts/components/autodiscover_new.php *
NAGIOSxi ALL = NOPASSWD:/usr/bin/php /usr/local/nagiosxi/scripts/send_to_nls.php *
NAGIOSxi ALL = NOPASSWD:/usr/local/nagiosxi/scripts/components/getprofile.sh
NAGIOSxi ALL = NOPASSWD:/usr/local/nagiosxi/scripts/upgrade_to_latest.sh
NAGIOSxi ALL = NOPASSWD:/usr/local/nagiosxi/scripts/change_timezone.sh
NAGIOSxi ALL = NOPASSWD:/usr/local/nagiosxi/scripts/manage_services.sh *
NAGIOSxi ALL = NOPASSWD:/usr/local/nagiosxi/scripts/reset_config_perms.sh
NAGIOSxi ALL = NOPASSWD:/usr/local/nagiosxi/scripts/manage_ssl_config.sh *
NAGIOSxi ALL = NOPASSWD:/usr/local/nagiosxi/scripts/backup_xi.sh *
NAGIOSxiWEB ALL = NOPASSWD:/etc/init.d/snmptt restart
NAGIOSxiWEB ALL = NOPASSWD:/usr/bin/tail -100 /var/log/messages
NAGIOSxiWEB ALL = NOPASSWD:/usr/bin/tail -100 /var/log/httpd/error_log
NAGIOSxiWEB ALL = NOPASSWD:/usr/bin/tail -100 /var/log/mysqld.log
NAGIOSxiWEB ALL = NOPASSWD:/usr/bin/php /usr/local/nagiosxi/scripts/components/autodiscover_new.php *
NAGIOSxiWEB ALL = NOPASSWD:/usr/local/nagiosxi/scripts/components/getprofile.sh
NAGIOSxiWEB ALL = NOPASSWD:/usr/local/nagiosxi/scripts/repair_databases.sh
NAGIOSxiWEB ALL = NOPASSWD:/usr/local/nagiosxi/scripts/manage_services.sh *
Best Regards,
Vinh
-
vtrac
- Posts: 903
- Joined: Tue Oct 27, 2020 1:35 pm
Re: Nagios xi services requiring sudo permissions don't work
Also, please follow this KB article and see if you can fix the "NRPE: Unable To Read Output" errors:
https://support.nagios.com/kb/article/n ... t-620.html
Best Regards,
Vinh
https://support.nagios.com/kb/article/n ... t-620.html
Best Regards,
Vinh
-
HIINNS
- Posts: 172
- Joined: Wed Mar 14, 2018 9:43 am
Re: Nagios xi services requiring sudo permissions don't work
I have tried everything in the article without success.
-
benjaminsmith
- Posts: 5324
- Joined: Wed Aug 22, 2018 4:39 pm
- Location: saint paul
Re: Nagios xi services requiring sudo permissions don't work
HI HIINNS,
I'm helping out on this forum as Vinh is out of the office this week. So the issue here is that the nagios user account on the remote host cannot run the scripts since those require sudo privileges.
We can verify this by logging into the remote system and run the plugin locally as root and then try logging in as the nagios user (su - nagios), and let me know what the results are.
If it does fail when you run the plugin as the nagios user, try to add the following line(s) to the /etc/sudoers file on the remote host.
Then modify the nrpe.cfg on the remote host and add sudo in front of the command for the plugin. If you have tried this already, are you able to share (in a private message) the nrpe.cfg file? Be sure to re-start nrpe ( systemctl restart nrpe ) after making any changes.
Regards,
Benjamin
I'm helping out on this forum as Vinh is out of the office this week. So the issue here is that the nagios user account on the remote host cannot run the scripts since those require sudo privileges.
We can verify this by logging into the remote system and run the plugin locally as root and then try logging in as the nagios user (su - nagios), and let me know what the results are.
If it does fail when you run the plugin as the nagios user, try to add the following line(s) to the /etc/sudoers file on the remote host.
Code: Select all
nagios ALL = NOPASSWD:/usr/local/nagios/libexec/<plugin>
Code: Select all
command[check_raid]=sudo /usr/local/nagios/libexec/<plugin>
Benjamin
As of May 25th, 2018, all communications with Nagios Enterprises and its employees are covered under our new Privacy Policy.
Be sure to check out our Knowledgebase for helpful articles and solutions!
Be sure to check out our Knowledgebase for helpful articles and solutions!
-
HIINNS
- Posts: 172
- Joined: Wed Mar 14, 2018 9:43 am
Re: Nagios xi services requiring sudo permissions don't work
command[check_init_service]=sudo /usr/local/nagios/libexec/check_init_service $ARG1$ -> found in /usr/local/nagios/nrpe/common.cfg
/usr/local/nagios/libexec/check_init_service -> found in /etc/sudoers
-rwxr-xr-x. 1 nagios nagios 1510 Jul 1 16:31 common.cfg -> permissions for common.cfg
This should work. It doesn't. It works on all Red Hat 7 servers. It doesn't work on Red Hat 8 servers.
/usr/local/nagios/libexec/check_init_service -> found in /etc/sudoers
-rwxr-xr-x. 1 nagios nagios 1510 Jul 1 16:31 common.cfg -> permissions for common.cfg
This should work. It doesn't. It works on all Red Hat 7 servers. It doesn't work on Red Hat 8 servers.