Re: Unable to restart, change sources, or delete sources
Posted: Fri Apr 30, 2021 2:00 pm
I did what was asked:
And then in /var/log/secure, I see the following:
Doing a ps -ef | grep 4893:
The /etc/sudoers file has the following at the bottom:
In /etc/sudoers.d/ we have nagiosna, which has:
So, it should have the ability to issue a kill command without password.
Code: Select all
[g018r@nagiosna ~]$ sudo bash
[sudo] password for g018r:
[root@nagiosna g018r]# sudo su - nna
Last login: Fri Apr 30 08:49:20 ADT 2021 on pts/0
[nna@nagiosna ~]$ /usr/local/nagiosna/bin/rc.py stop "DC - HH06 - DMZ Switch"
nna is not in the sudoers file. This incident will be reported.
DC - HH06 - DMZ Switch process stopped.Code: Select all
Apr 30 15:39:33 nagiosna sudo: nna : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/nna ; USER=nna ; COMMAND=/bin/kill 4893
Code: Select all
nna 4893 1 0 Apr29 ? 00:00:00 /usr/local/bin/nfcapd -I 143 -l /usr/local/nagiosna/var/DCHH06DMZSwitch/flows -p 9921 -x /usr/local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/DCHH06DMZSwitch/9921.pid -D -e -w -z -T all
nna 4894 4893 0 Apr29 ? 00:00:01 /usr/local/bin/nfcapd -I 143 -l /usr/local/nagiosna/var/DCHH06DMZSwitch/flows -p 9921 -x /usr/local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/DCHH06DMZSwitch/9921.pid -D -e -w -z -T allCode: Select all
#include /etc/customer/sudoers.host
#include.dir /etc/sudoers.d/Code: Select all
Defaults:%nnacmd !requiretty
Defaults:nna !requiretty
nna ALL = NOPASSWD:/usr/local/nagiosna/scripts/change_timezone.sh
nna ALL = NOPASSWD:/usr/local/nagiosna/scripts/upgrade_to_latest.sh
%nnacmd ALL=(ALL) NOPASSWD:/bin/kill *
%nnacmd ALL=(ALL) NOPASSWD:/usr/local/nagiosna/bin/rc.py *
%nnacmd ALL=(ALL) NOPASSWD:/usr/local/nagiosna/scripts/manage_firewall.sh *
%nnacmd ALL=(ALL) NOPASSWD:/usr/local/nagiosna/scripts/remove_source.sh *
%nnacmd ALL=(ALL) NOPASSWD:/usr/bin/systemctl restart httpd