I have a sensu handler that gets triggered on an endpoint Linux box (Centos 6.6. Here is the script I'm using:
#!/bin/bash --login
sudo -n -u deploy bash --login -c "cd /var/www/vhosts/sc/current; pwd; BUNDLE_GEMFILE=/var/www/vhosts/sc/current/Gemfile RAILS_ENV=production bundle exec pumactl -F /var/www/vhosts/sc/shared/config/puma.rb stop "
sudo -n -u deploy bash --login -c "cd /var/www/vhosts/sc/current; pwd; BUNDLE_GEMFILE=/var/www/vhosts/sc/current/Gemfile RAILS_ENV=production bundle exec pumactl -F /var/www/vhosts/sc/shared/config/puma.rb start "
Running this script locally as another user works fine and I can get puma to restart sanely. Even when I give sensu a shell and execute the script on the endpoint.
When it's triggered from the sensu server I get the output of:
{"timestamp":"2016-04-18T16:45:17.581962-0500","level":"info","message":"handler output","handler":{"type":"pipe","command":"/bin/sh /etc/sensu/handlers/puma_restart.sh","name":"puma_restart"},"output":["sudo: a password is required\n","sudo: a password is required\n"]}
I thought this might be an issue with sudoers so here's my setup:
Defaults:sensu !requiretty
Defaults:sensu secure_path = /usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
sensu ALL = NOPASSWD: /etc/sensu/handlers/puma_restart.sh
I've also tried setting the sudo NOPASSWORD for all commands like:
sensu ALL=(ALL) NOPASSWD: ALL
But I still get the error when the script is fired.
Anyone have an idea what I have setup wrong? If you need more details or context, please let me know.