0

First of all: I know there were already questions about this issue, but even using their answers I still cannot figure out why my command is not working.
What I want to do is call a script on remote host using NRPE. However, this what the script is going to do may be only executed by specific user (let's call him userA).

  • Now, my NRPE command looks like:

    command[debug_now]=/usr/local/bin/debug_now

  • My sudoers have entry nagios ALL=(tomcat) NOPASSWD: /usr/local/bin/debug_now as I noticed user calling the scripts from nrpe.cfg is called nagios.

  • Script /usr/local/bin/debug_now looks like:

    #!/bin/sh
    whoami
    echo "Debug..."
    sudo -u tomcat whoami
    echo "Debug finished"
    

Script above has same permissions as other scripts can be executed by user nagios. What's more, when it is executed locally it pretty prints:

nagios
Debug... 
tomcat
Debug finished

and it's generally working as intended. However, when it's called from management host, it prints only

nagios
Debug...
Debug finished

This is caused probably by NRPE: Cannot read output, which appears every time I try to sudo anything from management host. I already tried adding to sudoers entry Defaults !requiretty with no success. I use Debian 6.0.7. What can I do to make my script work, when called from management host?

EDIT.
First of all, directory /etc/sudoers.d/ contains only file README.
userA real name should be tomcat Let's take a look at visudo output then:

 Defaults        env_reset
 Defaults !requiretty
 root    ALL=(ALL) ALL
 nagios ALL=(tomcat)     NOPASSWD: /usr/bin/whoami

 %www ALL=(ALL) NOPASSWD: /bin/su - www
 %tomcat ALL=(ALL) NOPASSWD: /bin/su - tomcat
 %tomcat ALL=(ALL) NOPASSWD: /etc/init.d/tomcat stop
 %tomcat ALL=(ALL) NOPASSWD: /etc/init.d/tomcat start
 %tomcat ALL=(ALL) NOPASSWD: /etc/init.d/tomcat restart

Please note I tried even nagios ALL=(tomcat) NOPASSWD: ALL and nagios ALL=(ALL) NOPASSWD: ALL. I also removed few user entries like username ALL=(ALL) NOPASSWD: ALL.


NRPE

 $ tail -n 1 /etc/nagios/nrpe.cfg
 command[debug_now]=/usr/local/bin/debug_now


 $ ls -l /usr/local/bin/debug_now
 -rwxr-xr-x 1 root staff 573 Dec  2 09:06 /usr/local/bin/debug_now
 $ ls -lh /usr/local | grep bin
 drwxrwsr-x  2 root      staff 4.0K Dec  2 09:12 bin
 $ ls -lh /usr | grep local
 drwxrwsr-x  14 root staff 4.0K Oct 22  2010 local


From another host

$ /usr/lib/nagios/plugins/check_nrpe -H <ip address> -c debug_now
nagios
Debug...
Debug finished

3 Answers 3

2

Oh God, I feel so ashamed right now.

Everything is fine. You need to RESTART nagios-nrpe-server after changing sudoers, reload is not enough. Reload is fine if you only change nrpe.cfg or other config file.

@MadHatter, @Keith - thank you guys for your help!

1

Your sudoers entry specifies privileges to run /usr/local/bin/debug_now, but your script says sudo -u userA whoami. This will not work; whatever command you want to run with sudo privileges, that is what must appear in the sudoers file.

8
  • Hello and thanks for your answer. I tried adding entry nagios ALL=(userA) NOPASSWD: ALL in my sudoers. Script works if it's called locally (just like before), but still is not working when called from management host.
    – spoko
    Dec 1, 2014 at 11:59
  • @spoko: when you say "works if it's called locally", what do you mean? Do you mean if it's invoked from the local shell, or if it's called locally via NRPE?
    – MadHatter
    Dec 1, 2014 at 12:04
  • I used local shell to call the script as nagios: sudo -u nagios /usr/local/bin/debug_now.
    – spoko
    Dec 1, 2014 at 12:08
  • Might this be a more general NRPE problem? Have you any other commands running correctly from this server via NRPE?
    – MadHatter
    Dec 1, 2014 at 13:41
  • Yes, I do have a whole bunch of other commands. They all work fine, no matter if they are called from management host via NRPE or invoked in local shell. None of them uses sudo though.
    – spoko
    Dec 1, 2014 at 14:02
1

I tried to replicate your problem on a Debian Squeeze (6.0.10) box, but I had no trouble. If you set things up exactly like this (with the correct sudo setup, as MadHatter points out), including permissions and modes being correct, it will behave as you expect.

# ls -l /etc/sudoers.d/nagios-test 
-r--r----- 1 root root 44 Dec  1 11:36 /etc/sudoers.d/nagios-test
# cat /etc/sudoers.d/nagios-test 
nagios ALL=(keith)  NOPASSWD:/usr/bin/whoami

# tail -n 1 /etc/nagios/nrpe.cfg
command[debug]=/usr/local/bin/debug
# ls -l /usr/local/bin/debug
-rwxr-xr-x 1 root staff 75 Dec  1 11:37 /usr/local/bin/debug

# cat /usr/local/bin/debug
#!/bin/sh
whoami
echo "Debug..."
sudo -u keith whoami
echo "Debug finished"

From another host:

$ ./check_nrpe -H squeeze -c debug
nagios
Debug...
keith
Debug finished
3
  • +1 from me; that's heroic!
    – MadHatter
    Dec 1, 2014 at 17:47
  • Mostly because I couldn't think of anything that would cause the stated problem, so was starting to question my own sanity. Wanted to double-check that we were providing correct information.
    – Keith
    Dec 1, 2014 at 18:14
  • @Keith if only I could +1 your answer, I would. Thanks for your effort, that's truely heroic and therefore I feel doomed, as this doesn't work. I edited my question, added few more things MadHatter asked.
    – spoko
    Dec 2, 2014 at 8:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .