Thanks everyone for the responses. The 'systrace' thing went over my head I'm afraid and the Solaris man page for that command isn't helping me much. To make things clearer, the setup I'm proposing is this: 1. # /usr/local/sbin/visudo ... nagios ALL=(ALL) NOPASSWD: /usr/local/nagios/libexec/check_logfiles -f /usr/local/nagios/etc/check_logfiles.cfg 2. # vi /usr/local/nagios/etc/nrpe.cfg ... command[check_logfiles]=/usr/local/bin/sudo /usr/local/nagios/libexec/check_logfiles -f /usr/local/nagios/etc/check_logfiles.cfg 3. # grep nagios /etc/passwd nagios:x:1123:100:Nagios Remote User:/usr/local/nagios:/usr/bin/bash Note to Hari: my understanding is that sudo won't work for account that doesn't have a valid shell. Certainly all my testing led me to that conclusion. 4. # passwd -l nagios It's not clear to me exactly what the security risk is. The idea is that someone may gain access to an unprivileged account on the system and then use this access and this Nagios plugin to cause mailicious damage? Or to break the root account? In which case, it would all come down to how secure the code of the plugin is. Is this correct? Kind Regards, Alex <div>On 9/1/06, julien Touche <<a href="mailto:julien.touche@touche.fr.st">julien.touche@touche.fr.st</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Alexander Harvey wrote on 31/08/2006 16:10: > I have a difficult customer who won't sign off changes based on the > security > risk using suid plugins, for example, check_logfiles. What does one do > about > this situation? $ cat /usr/local/share/doc/nagios-plugins/README.OpenBSD Some nagios plugins need elevated privileges to run properly. As the code quality of these plugins is not really good, they are not installed suid root by default, but instead I suggest running them with systrace's privilege elevation feature. This way they are run as _nagios, but single syscalls are run as root. 1) Create a preliminary systrace policy for the plugin. # cd ${PREFIX}/libexec/nagios # systrace -A -d /tmp ./<plugin> <plugin arguments> This creates a policy for the plugin <plugin> in /tmp. 2) Refine the policy and configure privilege elevation as required. This is an example, permitting the bind(2) syscall as root. native-bind: sockaddr eq "inet-[<a href="http://0.0.0.0">0.0.0.0</a>]:68" then permit as root 3) Copy the systrace policy to /etc/systrace. 4) Run visudo as root and configure sudo for user _nagios like this. _nagios ALL=NOPASSWD: /bin/systrace -a -c 550\:550 \ ${PREFIX}/libexec/nagios/<plugin> <plugin arguments> 5) Configure the respective command in nagios. define command { command_name check_dhcp command_line sudo /bin/systrace -a -c 550:550 $USER1$/<plugin> <plugin arguments> } 6) In case of problems, systrace will log to /var/log/messages. Regards Julien </blockquote></div>