Page 1 of 2
check_expiry
Posted: Wed May 15, 2019 11:49 am
by hardik185
Hi, I am using check_expiry on Linux (RHEL 6) but while running it with check_nrpe, I always get "NRPE: Unable to read output"
I can see nagios is not able to execute this script to check user's password expiry information. any idea on how this can be achieved?
Re: check_expiry
Posted: Wed May 15, 2019 4:47 pm
by cdienger
Edit line 15 to look like:
Code: Select all
if [[ $get_expiry_date == *"Never"* ]]
Test again and let us know the results. If it still fails, try running the script directly on the host and not using check_nrpe:
Re: check_expiry
Posted: Wed May 15, 2019 5:00 pm
by npolovenko
@hardik185, On top of what Craig recommended, I suggest adding the following entries to the /etc/sudoers file on the nrpe server.
Code: Select all
nagios ALL = NOPASSWD:/tmp/check_expiry.sh
nagios ALL = NOPASSWD:/usr/sbin/lchage
Re: check_expiry
Posted: Fri May 24, 2019 10:19 am
by hardik185
Hi,
Thanks for your response.
I have tried both but I still get the same error.
strace does not really help. If I run the script as nagios user I get the right output. It is just check_nrpe does not give.
/usr/local/nagios/libexec/check_nrpe -H 127.0.0.1 -c check_appuser
NRPE: Unable to read output
Any idea?
Re: check_expiry
Posted: Fri May 24, 2019 2:55 pm
by npolovenko
@hardik185, Can you show us the check_appuser command in the nrpe.cfg file? Please upload the whole npre.cfg file so I could examine your settings.
Also, if your plugin is in the /usr/local/nagios/etc/libexec/ folder, then you need to adjust entries in the sudoers file to reflect that:
Code: Select all
nagios ALL = NOPASSWD:/usr/local/nagios/etc/libexec/check_expiry.sh
nagios ALL = NOPASSWD:/usr/sbin/lchage
Re: check_expiry
Posted: Tue May 28, 2019 7:05 am
by hardik185
Hi @npolovenko,
Sure. I have added the entries as suggested in /etc/sudoers but still same output. Please find attached nrpe.cfg and suggest if there is any way to enable this check.
Re: check_expiry
Posted: Tue May 28, 2019 4:08 pm
by npolovenko
@hardik185, Open the /etc/sudoers file and add the following entries instead of just two entries that I recommended earlier.
Defaults: nrpe !requiretty
Defaults: nagios !requiretty
nagios ALL = NOPASSWD:/usr/local/nagios/etc/libexec/check_expiry.sh
nagios ALL = NOPASSWD:/usr/sbin/lchage
nagios ALL = NOPASSWD: /sbin/service,/usr/bin/systemctl,/usr/sbin/service
nrpe ALL = NOPASSWD: /sbin/service,/usr/bin/systemctl,/usr/sbin/service
Open the /usr/local/nagios/libexec/check_expiry.sh script on the line 14, and change it to look like this:
Code: Select all
get_expiry_date=$(sudo /usr/sbin/lchage -l $1 | grep 'Password Expires' | cut -d: -f2)
I added "sudo".
Let me know if this fixes the issue.
Re: check_expiry
Posted: Fri May 31, 2019 6:00 am
by hardik185
hi @npolovenko ,
I have added entries in sudoer file as suggested but did not help. not sure what is still missing.
Re: check_expiry
Posted: Fri May 31, 2019 4:07 pm
by npolovenko
@hardik185, Please switch to the nagios user, run the plugin and show us the output:
Code: Select all
su - nagios
/usr/local/nagios/libexec/check_expiry.sh
Please upload the /etc/sudoers file and upload the plugin with the modifications we suggested here as well.
Re: check_expiry
Posted: Thu Jun 13, 2019 11:08 am
by hardik185
sorry for replying late @npolovenko
I am able to run it successfully with "su - nagios"
-bash-4.1$ /usr/local/nagios/libexec/check_expiry.sh appuser1
OK - Password never expires
-bash-4.1$ vim /usr/local/nagios/etc/nrpe.cfg
-bash-4.1$ /usr/local/nagios/libexec/check_expiry.sh appuser2
OK - Password is 61 days from expiry
-bash-4.1$ /usr/local/nagios/libexec/check_nrpe -H 127.0.0.1 -c check_appuser
NRPE: Unable to read output
-bash-4.1$
Below are the entries added in /etc/sudoers,
nagios ALL = NOPASSWD:/usr/local/nagios/etc/libexec/check_expiry.sh *
nagios ALL = NOPASSWD:/usr/sbin/lchage -l *
nagios ALL = NOPASSWD: /sbin/service,/usr/bin/systemctl,/usr/sbin/service
nrpe ALL = NOPASSWD: /sbin/service,/usr/bin/systemctl,/usr/sbin/service
Below is the line updated in plugin,
function calculate_days_till_expiry {
get_expiry_date=$(sudo /usr/sbin/lchage -l $1 | grep 'Password Expires' | awk '{print $3}')
Can you review and suggest?