On Nov 29, 2010, at 3:04 PM, Jason Holtzapple wrote:

> On 11/29/2010 12:45 PM, Alex Dean wrote:
>> I have Nagios running on a local server, and I occasionally get some emails from it with the subject "*** SECURITY information for <hostname>***".  The body of the message is just a few characters.  I've done some searching in my Nagios logs and online, and I have no idea what these emails are or what they mean.
>> 
>> The latest instance was last night.  I had my local network torn apart for a few hours, and when I reconnected everything, I had about 40 of these emails waiting for me.
>> 
>> The Nagios I'm using is from Ubuntu 9.10.  I'm using only a very few HTTP, ssh, & ping monitors.  Nothing complex at all.
> 
> sudo creates emails with subjects like that if there are security
> issues, but the body of your mail is not typical of sudo. Do any of your
> nagios checks use sudo as part of the check?

Nice fine.  My checks using check_ide_smart do use sudo.

define command{
        command_name    check_smartd
        command_line    /usr/bin/sudo /usr/lib/nagios/plugins/check_ide_smart -d $ARG1$ -n 
}
define service{
        use                             generic-service
        host_name                       localhost
        service_description             SMART status 2
        check_command                   check_smartd!/dev/disk/by-id/scsi-SATA_WDC_WD6401AALS-_WD-WCASY7715793
}


/etc/sudoers
  nagios ALL = NOPASSWD: /usr/lib/nagios/plugins/check_ide_smart


For the example SECURITY email I sent (dated Nov 28, 21:29:59), /var/log/auth.log has a record:
Nov 28 21:29:59 artichoke sudo:   nagios : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/lib/nagios/plugins/check_ide_smart -d /dev/disk/by-id/scsi-SATA_WDC_WD6401AALS-_WD-WCASY7715793 -n

As far as I can tell, that looks normal.  The smartd checks were never in error while my network was down.  I'm only using local passwd/group/shadow files for authentication, no LDAP or yp or other external authentication service.

alex
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss