Jeremy Chadwick wrote:
On Thu, Oct 16, 2008 at 11:36:51PM +0200, Per olof Ljungmark wrote:
Mel wrote:
On Thursday 16 October 2008 22:07:43 Per olof Ljungmark wrote:
Per olof Ljungmark wrote:
Daniel Bye wrote:
On Thu, Oct 16, 2008 at 12:05:01PM +0100, Daniel Bye wrote:
It is possible to configure sudo to run only exactly the required
command
(including arguments) precisely to guard against this type of abuse -
I use it extensively in my own nagios setup.
This Cmnd_Alias in sudoers will do the trick:
Cmnd_Alias NAGIOS_CMNDS = /sbin/camcontrol inquiry da0
man sudoers for more information about what you can do with sudo.
I just realised this example is woefully incomplete - apologies for
that.
There are a few ways you can set up /usr/local/etc/sudoers (make sure
you use visudo to edit it, as it will catch any syntax errors for you,
thus helping somewhat to prevent breaking your setup).
The simplest case will just be to allow nagios to run the command, as
root,
without a password:
nagios ALL=(root) NOPASSWD: /sbin/camcontrol inquiry da0
If, as is quite possible, nagios should be able to run more than just
that one command, you can define a Cmnd_Alias, as above. To include more
than one command in the alias, simply separate them with a comma. You
can use `\' to escape newlines and make your file a little easier to
read:
Cmnd_Alias NAGIOS_CMNDS = /sbin/camcontrol inquiry da0 \
/sbin/camcontrol inquiry da1
and so on. Now, to use that alias, set the user's permissions to
nagios ALL=(root) NOPASSWD: NAGIOS_CMNDS
^^^^
For the records, even this won't work because nagois needs access to
/dev/xpt0 as well and once there sudo can't help.
sudo -u nagios /sbin/camcontrol inquiry da0
camcontrol: cam_lookup_pass: couldn't open /dev/xpt0
cam_lookup_pass: Permission denied
The idea is to let this be run as root, tho personally, I'd put nagios
in a group that can rw /dev/xpt0, /dev/pass0 and /dev/da0, setup
devfs.rules properly and the let it execute a script that does the
inquiry and the inquiry only.
On a related note, it would be a 'nice to have', if the more dangerous
commands of camcontrol had a sysctl knob that only allows them to be
executed only as root.
But... the command "/sbin/camcontrol inquiry da0" IS run as root through
the setup in sudoers above, but it is not enough or I'm overseeing
something. Anyway, I've already decided to scrap the sudo idea, too
kludgy for me.
Scrapping it is fine, but you still aren't understanding how to use
sudo.
The -u flag tells sudo what UID to switch to. Meaning, your above
command (sudo -u nagios /sbin/camcontrol...) tells the system "run
/sbin/camcontrol as user nagios". This **does not** tell the system
to run /sbin/camcontrol as user root.
For example, let's say you're logged in as user nagios (or running
commands as user nagios):
[EMAIL PROTECTED] sudo -u nagios whoami
nagios
[EMAIL PROTECTED]
This obviously isn't what you want -- this tells sudo to switch to
UID nagios (you already ARE this user!) and run the "whoami" command.
But this IS what you want:
[EMAIL PROTECTED] sudo whoami
root
[EMAIL PROTECTED]
You'll need to use visudo(8) to configure sudo to 1) permit user
"nagios" to use sudo (and switch to UID root), and 2) to ONLY RUN
/sbin/camcontrol when sudo is run, otherwise someone could do:
[EMAIL PROTECTED] sudo rm -fr /
You get the point now, I'm sure.
Yep, promise :-)
I'm off to bed but will try to work out the sudo magic tomorrow although
I'm still incloned to an alternative solution.
--
per
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
