At no point should the Nagios server be able to run arbitrary command on monitored systems (aka only non-logonable ids), i.e. no value can be dynamically pass between the client and the server. The SSH server (i.e. munin-client) must use the SSH key to define which command to execute.
Define per-command ssh keys - ssh-keygen.
e.g. /home/nagios/dns
#!/bin/bash
echo `ssh -i /home/nagios/.ssh/bacula_rsa -q [email protected]`
exit $?If the command is simple, put it right within the forced command= of the authorized_keys file
e.g. /home/nagios/.ssh/authorized_keys - dns check - dig ...
no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="dig @192.168.2.92 soa mantor.org -p5353 +multiline +dnssec | egrep 'serial|status: '" ssh-rsa AAAA...Z7 nagios
If the command is too complex to stand in the command= field or if sudo is needed,
e.g. /home/nagios/.ssh/authorized_keys - xyz - ~/the-script
no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="~/xyz" ssh-rsa AAAA....21 nagios
e.g. /home/nagios/.ssh/authorized_keys - mysqlreq - sudo ~/the-script
no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="sudo ~/mysqlreq" ssh-rsa AAAA....21 nagios
All script within ~/nagios/sudo directory can be run with sudo with the following sudoers config:
i.e. /usr/local/etc/sudoers.d/nagios
nagios ALL=(root) NOPASSWD: /home/nagios/sudo/*
Defaults:nagios !requiretty
The last line remove the need to disable no-pty for sudo commands.
e.g. /home/nagios/.ssh/authorized_keys - mysqlreq - sudo ~/sudo/myqlreq
no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="sudo ~/sudo/mysqlreq" ssh-rsa AAAA....EA nagios
BIG BOLD WARNING HERE
The security of this mechanism depends on the control root has over the scripts authorized by sudo to be actually controlled by root.
- files within
/home/nagios/sudoMUST only be writable by root-rwxr-xr-x root - the directory
/home/nagios/sudoMUST only be writable by root-rwxr-xr-x root - the user's directory
/home/nagiosMUST only be writable by root-rwxr-xr-x root
Assume everything in this directory can be executed by anyone as root.
p.s. Yes, that's a bit overkill since nagios user is really an administrator and nothing else then this get executed by this user but anyway, doing it like this keeps a clean distinction between a privilege id root and a non-privilege id nagios.
Use with sudo config and divert the command back to the jail using something like this:
e.g. /home/nagios/sudo/mysqlreq
#!/bin/sh
jexec `jls | grep secor | awk '{print $1}'` /home/nagios/mysqlrepn.b. jids are dynamically pulled