Not authorized to commit the specified command.

[wschwarz]

Nagios Core 4.3.1

I believe the problem is related to nagios/etc/cgi.cfg where I have configured:
authorized_for_all_services=user1,user2
authorized_for_all_hosts=user1,user2

user1 and user2 are unable to schedule downtime for hosts that they are not a contact for
user1 and user2 are able to schedule downtime for hosts that they are a contact for

For example, switch1. user1 and user2 are unable to schedule downtime on this host, but user3 and user4 are able to schedule downtime on this host.
If user1 and user2 are added to the contact group network they are able to schedule downtime for this host.

Hosts are configured in this way:

Code: Select all

define contactgroup{
contactgroup_name network
alias Network
members user3,user4
}

define hostgroup{
hostgrou_name switches
alias network switches
}

define host {
name switch_host
max_check_attempts 6
check_command check-host-alive
passive_checks_enabled 1
check_period 24x7
obsess_over_host 1
check_freshness 0
event_handler_enabled 1
flap_detection_enabled 1
process_perf_data 0
retain_status_information 1
retain_nonstatus_information 1
contact_groups network
notification_interval 0
notification_period 24x7
notification_options d,r,f
notifications_enabled 1
icon_image switch40.gif
statusmap_image switch40.gd2
register 0
}

define host{
use             switch_host
host_name       switch1
alias           Switch1
address         192.168.1.100
hostgroups      switches
notes           Network
parents         building-mdf
}

[scottwilkerson]

This is exactly how it is supposed to be.

If you want user1 and user2 to be able to submit the commands when they are not contacts for the items, you need to add them to these in the cgi.cfg

Code: Select all

authorized_for_all_service_commands=user1,user2
authorized_for_all_host_commands=user1,user2

The one you had, lets them see all the host and services, the above lets them submit commands for all hosts/services

[wschwarz]

This is how my system is configured however the problem remains. Users cannot put systems they are not contacts for into downtime.

Thanks for the confirmation I'm doing this correctly, we'll work around this until we are able to install a new version.

[kyang]

Interesting, I'll double check the latest version to see what happens.

Was the service nagios restarted when testing?

Code: Select all

service nagios restart

Did you have any more questions or were you going to install the new version when you could?

[wschwarz]

Yes, the service has been restarted after making the change.

If there was a way to get this working my team would really like the ability to place a system in downtime without being on the call list when that system is down.

I am hesitant to update to a newer version without knowing that this problem would be fixed (is there a newer version?) given that I would need to arrange for downtime in our monitoring service.

I will scratch my head and try a few more things like file permissions to see if I can get this working.

[lmiltchev]

I just tested this in Nagios Core 4.3.4. I created two users 0 user1, and user2. I haven't added them as monitoring contacts to any of my hosts. In the cgi.cfg, I have:

Code: Select all

authorized_for_all_services=nagiosadmin,user1,user2
authorized_for_all_hosts=nagiosadmin,user1,user2

authorized_for_all_service_commands=nagiosadmin,user1,user2
authorized_for_all_host_commands=nagiosadmin,user1,user2

I am able to log in as user1 or user2, and schedule downtime on my hosts just fine.

In addition to restarting the nagios service, have you restarted apache as well?

Is apache added to the nagios group? Can you run the following command and show the output?

Code: Select all

grep nag /etc/group

[wschwarz]

Yes, apache has been restarted as well.

Code: Select all

# grep nag /etc/group
nagios:x:1000:apache
nagcmd:x:1001:nagios,apache

Thanks for the continued help!

[lmiltchev]

Can you zip up the "/usr/local/nagios" directory, and PM it to me or any other member of the Nagios Support? We will try to recreate the issue in-house. Thanks!

[npolovenko]

@wschwarz, In your cgi.cgf file please change:

Code: Select all

authorized_for_all_host_command=ecloss,***,***,***

to

Code: Select all

authorized_for_all_host_commands=ecloss,***,***,***

commands needs to be plural.

And then restart the nagios service:

Code: Select all

service nagios restart

[wschwarz]

Wow.

That works (of course)! I have no idea how that typo got into our config but it is now working again.

Thanks!