Re: setcap plugin failing
Justin Azoff <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAPfnCugn_fG4L7QnnE6Nxtr=pMNr_ucpKwc0KW1XoO5a5Gi8OA@mail.gmail.com> |
Is the account you are using zeek or bro? your prompt says zeek but the sudoers file says bro. On Tue, May 7, 2019 at 9:35 AM Mark Gardner <[email protected]> wrote: > > I can't figure out how to debug this issue of the setcap plugin failing: > > zeek@zeekmgr:~$ broctl install > ... > setcap plugin: executing setcap on each node: > 10.0.1.12 - Executing setcap: FAIL: > ... > > Details:: > > OS: Debian9 > Zeek: v2.6.1 installed from source into /usr/local/bro > Plugins: af_packet installed from source and PingTrip/broctl-setcap setcap.py file installed by hand into /usr/local/bro/lib/broctl/plugins. > > The following is appended to the bottom /usr/local/bro/etc/broctl.cfg: > # Configure broctl-setcap plugin > setcap.enabled=1 > setcap.command=sudo /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/bro && sudo /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/capstats > > And this to /etc/sudoers.d/zeek on each of the sensors: > Cmnd_Alias BRO_SETCAP = /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/bro > Cmnd_Alias CAPSTATS_SETCAP = /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/capstats > bro ALL=NOPASSWD: BRO_SETCAP, CAPSTATS_SETCAP > Defaults!/sbin/setcap !requiretty > > Any ideas what to check to see what is going wrong? > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek -- Justin _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek