Agents getting prompted for password entry to stdout?

[Optic_hyperic]

Evaluating Hyperic HQ here, and I have run into a very interesting issue.
Systems involved are Solaris 10 with zones, HQ Open Source, out of the box configuration with very little work.

Here, is what I get:

hyperic@manticore$ ./hq-agent.sh start
Starting agent
- Invoking agent
- Starting agent process
Agent successfully started
hyperic@manticore$ Password:
Password:
Password:

Repeat ad infinitum. This occurs on all agents. I have set up SSH keys between the agents and the master, and agents have sudo privileges with the NOPASSWD option.

User_Alias AGENTS = hyperic
Cmnd_Alias HYPERIC = /export/home/hyperic/pdk/work/scripts*
AGENTS ALL = NOPASSWD: HYPERIC

Can anyone tell me what's causing this issue, and how I can resolve it?
Thanks!

[pwebb]

I get the same thing, though right after upgrading server and agent from 3.0.5 to 3.1.0. I am also using SSH Keys.

[jduino]

I can't solve it, but I'll add that it is also happening to me on a
single-host install (server & agent) on a RH9. v3.1 Open Source

> Evaluating Hyperic HQ here, and I have run into a very interesting issue.
> Systems involved are Solaris 10 with zones, HQ Open Source, out of the box
> configuration with very little work.
>
> Here, is what I get:
>
> hyperic@manticore$ ./hq-agent.sh start
> Starting agent
> - Invoking agent
> - Starting agent process
> Agent successfully started
> hyperic@manticore$ Password:
> Password:
> Password:
>
> Repeat ad infinitum. This occurs on all agents. I have set up SSH keys
> between the agents and the master, and agents have sudo privileges with
> the NOPASSWD option.
>
> User_Alias AGENTS = hyperic
> Cmnd_Alias HYPERIC = /export/home/hyperic/pdk/work/scripts*
> AGENTS ALL = NOPASSWD: HYPERIC
>
> Can anyone tell me what's causing this issue, and how I can resolve it?
> Thanks!
>

[jduino]

Looking in my agent logs I see this, so I'd say it has something to do
with the new sendmail plugin:

2007-08-15 11:12:46,123 INFO [Execute] waitFor() interrupted
2007-08-15 11:12:47,126 ERROR [ExecutableProcess] Timeout running [sudo
pdk/work/scripts/sendmail/hq-sendmail-stat ]

> Evaluating Hyperic HQ here, and I have run into a very interesting issue.
> Systems involved are Solaris 10 with zones, HQ Open Source, out of the box
> configuration with very little work.
>
> Here, is what I get:
>
> hyperic@manticore$ ./hq-agent.sh start
> Starting agent
> - Invoking agent
> - Starting agent process
> Agent successfully started
> hyperic@manticore$ Password:
> Password:
> Password:
>
> Repeat ad infinitum. This occurs on all agents. I have set up SSH keys
> between the agents and the master, and agents have sudo privileges with
> the NOPASSWD option.
>
> User_Alias AGENTS = hyperic
> Cmnd_Alias HYPERIC = /export/home/hyperic/pdk/work/scripts*
> AGENTS ALL = NOPASSWD: HYPERIC
>
> Can anyone tell me what's causing this issue, and how I can resolve it?
> Thanks!
>

[scottmf]

Hi,
There is a fix for this.

Please see, http://jira.hyperic.com/browse/HHQ-1032

The updated plugin is attached along with instructions of how to update HQ.

Scott

[pwebb]

hum, applying the updated sendmail plugin still doesn't solve the problem for me.

2007-08-15 12:27:47,568 INFO [Execute] waitFor() interrupted
2007-08-15 12:27:49,573 ERROR [ExecutableProcess] Timeout running [sudo pdk/work/scripts/sendmail/hq-sendmail-stat ]
2007-08-15 12:32:49,790 INFO [Execute] waitFor() interrupted
2007-08-15 12:32:51,794 ERROR [ExecutableProcess] Timeout running [sudo pdk/work/scripts/sendmail/hq-sendmail-stat ]

Wonder if it has something to do with me applying the other fix for HQ secure agent communications: http://jira.hyperic.com/browse/HHQ-980

[JohnMarkOrg]

Thanks. I'll update the forge with this info.

-JM


Scott Feldstein wrote:
> Hi,
> There is a fix for this.
>
> Please see, http://jira.hyperic.com/browse/HHQ-1032
>
> The updated plugin is attached along with instructions of how to update HQ.
>
> Scott
>

[Optic_hyperic]

Thanks for the pointer, Scott. However..

hyperic@manticore$ wget http://jira.hyperic.com/secure/attachment/11610/sendmail-plugin.xml
--10:40:44-- http://jira.hyperic.com/secure/attachment/11610/sendmail-plugin.xml
=> `sendmail-plugin.xml'
Resolving jira.hyperic.com... 69.59.181.106
Connecting to jira.hyperic.com|69.59.181.106|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5,229 (5.1K) [text/xml]

100%[====================================>] 5,229 --.--K/s

10:40:44 (180.19 KB/s) - `sendmail-plugin.xml' saved [5229/5229]

hyperic@manticore$ mv sendmail-plugin.xml pdk/plugins/sendmail-plugin.xml
hyperic@manticore$ ./hq-agent.sh stop
Stopping agent ...
Success -- agent is stopped!
hyperic@manticore$ ./hq-agent.sh start
Starting agent
- Invoking agent
- Starting agent process
Agent successfully started
hyperic@manticore$ Password:
Password:

A more confusing thing I should point out here, is that the hyperic user is in the sudoers file and is set for nolecture, and no password.

-- Edit below here

So, here's the problem.
sudo requires you provide absolute path or wildcarding. You also need to run it as an absolute path. If you look at the sendmail script, it describes adding $AGENT_INSTALL/pdk/scripts/... yadda.
However, it doesn't call that, so sudo doesn't work. It calls pdk/scripts/work/yadda. (Not at the office at the moment, so can't get the exacts.)
Obviously, the fix is to change it to call $AGENT_INSTALL/pdk/scripts/work/yadda. However, I don't see how you can wildcard, or even use $HOME to give it an absolute path to work with.
I'll test in the morning by hardcoding absolute path based on my install here.

Solution partly found, maybe.

Message was edited by: Optic

[scottmf]

I apologize, you need to delete sendmail from your server inventory completely and let HQ reimport it. I changed the config props so that you need to explicitly tell it to use sudo or the script will just fail silently.

Right now the sudo command is still being scheduled via the HQ server. That is why you are still seeing Password: pop up.

As far as the absolute path goes, check it again after sendmail is re-imported. Then let me know if it fails. I don't think that is an issue. And don't forget to configure your plugin to use sudo or else you won't get many metrics.

[Optic_hyperic]

Finally got a chance to test this; yes, the updated xml does indeed fix all of the sendmail issues after removing and readding. Working beautifully now. Thanks!