Hello,
Le 2015-04-29 21:08, Stuart Cracraft a écrit :
This is a half-hearted, strange attempt to draconianly
say "all uid=0" is bad and feels suspiciously nannyish, big-government.
This should be configurable. Security vs Liberty.
However, if that were configurable, I would set allow_execute_with_UID0
as false.
I explain below.
In fact, there are many commands which require root to
access protected files or devices and which do not have
non-Exec collectd-generic-support but constitute invaluable
information to have collected, graphed and alarmed on.
True
I am surprised at the above decision and am asking
the community how you collect root-accessible-only data
in collectd when there no plugin exec, nor otherwise, to collectd.
You can use sudo.
Create a specific user (that will execute the Exec script) and give that
user the right to run the command with sudo without password.
Why would I configure allow_execute_with_UID0=false ? Because the script
to be executed by Exec plugin does not need root privileges.
Moreover, I like to script a loop to prevent Exec plugin to fork and run
the script every minute (or whatever the interval you specified). I also
parse the result of the command and reformat for Plain Text Protocol.
That does not need root privilege.
The only command that need root privilege, well, you can use sudo for
that.
And with sudo, you can also track who is doing what. Good point !
Of course, there are other ways to get root privileges on some OS.
Of course, my method does not work if your script is not a script but a
binary that does all (including conversion of the result to Plain Text
Protocol).
Well, that's only how I do. Not the Universal Way of Doing Things.
I'd like to hear other opinions too.
Regards,
Yves
_______________________________________________
collectd mailing list
collectd@verplant.org
http://mailman.verplant.org/listinfo/collectd
