influxdata / influxdata/telegraf
[inputs.ipmi_sensor] Sudo with custom PAM
- Dominant language
- Go
- Stars
- 17.8k
- Forks
- 5.8k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 161
Description
## Feature Request
We use a nonhuman user named `telegraf` to run telegraf. To authenticate nonhuman users, we use a custom PAM for `sudo`. We configure the `ipmi_sensor` input plugin with `use_sudo=true`, and we configure sudoers carefully, so that user `telegraf` can execute the `ipmi` command.
However, the `use_sudo` configuration option causes the `-n` option to be passed to `sudo` as shown below:
https://github.com/influxdata/telegraf/blob/38aefd99b55450a6338c3e843487712110c2f3d2/plugins/inputs/ipmi_sensor/ipmi.go#L164-L168
When given this option, and the last-run timestamp for `sudo` is old, then `sudo` exits without calling into the PAM:
https://github.com/sudo-project/sudo/blob/bb5843055ef0c3b84254769926f07cc9d668288b/plugins/sudoers/check.c#L128-L133
Consequently, the input plugin cannot work.
### Proposal:
Add a new configuration field to the input plugin that skips adding `-n` for our use case. Presumably, the plugin would need to change how it deals with the `sudo` command outcome.
### Current behavior:
Plugin does not work.
### Desired behavior:
Plugin works.
### Use case:
See above. Sorry, not used to writing issues. Let me know if you need any more information.
Contributor guide
Research direction
Start in plugins/inputs/ipmi_sensor/ipmi.go around the linked command construction at lines 164-168, then review how the plugin handles the sudo command outcome. Compare the behavior with the linked sudoers and PAM references. Done means the new configuration supports custom PAM authentication while preserving existing use_sudo behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, devops
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100