Re: [Nagios-devel] Problem with ping-check?
Posted: Mon Oct 15, 2007 4:49 am
* Andreas Ericsson [2007-10-15 14:34]:
> Matthias Eble wrote:
> >> I've moved from check_ping to check_icmp.
> >> If check_ping can produce unnecessary alerts then why not simply symlink
> >> check_ping to check_icmp or remove it?
> >
> > because check_icmp needs root privileges (setuid root). check_ping can
> > be run without uid 0 because ping already has setuid root.
> > check_icmp can only be installed with root privileges.
>
> Well, it's bugs in /bin/ping or bugs in check_icmp. Both of them drop
> root privs immediately after having obtained the raw socket, so the attack
> vector is severely limited.
Personally, though I do recommend to use check_icmp whenever possible, I
would not like making root privileges a requirement to get some
check_ping/check_icmp plugin installed. I'm not root on all Nagios
systems I maintain.
Holger
This post was automatically imported from historical nagios-devel mailing list archives
Original poster: [email protected]
> Matthias Eble wrote:
> >> I've moved from check_ping to check_icmp.
> >> If check_ping can produce unnecessary alerts then why not simply symlink
> >> check_ping to check_icmp or remove it?
> >
> > because check_icmp needs root privileges (setuid root). check_ping can
> > be run without uid 0 because ping already has setuid root.
> > check_icmp can only be installed with root privileges.
>
> Well, it's bugs in /bin/ping or bugs in check_icmp. Both of them drop
> root privs immediately after having obtained the raw socket, so the attack
> vector is severely limited.
Personally, though I do recommend to use check_icmp whenever possible, I
would not like making root privileges a requirement to get some
check_ping/check_icmp plugin installed. I'm not root on all Nagios
systems I maintain.
Holger
This post was automatically imported from historical nagios-devel mailing list archives
Original poster: [email protected]