influxdata / influxdata/telegraf

[inputs.ipmi_sensor] Sudo with custom PAM

Open
#10,056 4 comments 0 reactions 0 assignees View on GitHub
feature request
Dominant language
Go
Stars
17.8k
Forks
5.8k
Avg merge
1d 20h
Merged PRs (30d)
161

Description

## Feature Request

We use a nonhuman user named `telegraf` to run telegraf. To authenticate nonhuman users, we use a custom PAM for `sudo`. We configure the `ipmi_sensor` input plugin with `use_sudo=true`, and we configure sudoers carefully, so that user `telegraf` can execute the `ipmi` command.

However, the `use_sudo` configuration option causes the `-n` option to be passed to `sudo` as shown below:

https://github.com/influxdata/telegraf/blob/38aefd99b55450a6338c3e843487712110c2f3d2/plugins/inputs/ipmi_sensor/ipmi.go#L164-L168

When given this option, and the last-run timestamp for `sudo` is old, then `sudo` exits without calling into the PAM:

https://github.com/sudo-project/sudo/blob/bb5843055ef0c3b84254769926f07cc9d668288b/plugins/sudoers/check.c#L128-L133

Consequently, the input plugin cannot work.

### Proposal:

Add a new configuration field to the input plugin that skips adding `-n` for our use case. Presumably, the plugin would need to change how it deals with the `sudo` command outcome.

### Current behavior:

Plugin does not work.

### Desired behavior:

Plugin works.

### Use case:

See above. Sorry, not used to writing issues. Let me know if you need any more information.

Contributor guide

Open the contributing guide

Research direction

Start in plugins/inputs/ipmi_sensor/ipmi.go around the linked command construction at lines 164-168, then review how the plugin handles the sudo command outcome. Compare the behavior with the linked sudoers and PAM references. Done means the new configuration supports custom PAM authentication while preserving existing use_sudo behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, devops
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.