Sample Header Ad - 728x90

snmptt running as non-root, writting to file as root

0 votes
1 answer
2801 views
I'm running snmptt as a SNMP trap handler for snmptrapd, with the aim being to write to a trap file that can be read and processed by Zabbix. I have set up snmptt to run as the zabbix user by changing the init script. # grep daemon /etc/init.d/snmptt # description: SNMP Trap Translator daemon # Short-Description: SNMP Trap Translator daemon OPTIONS="--daemon" daemon --user=zabbix /usr/sbin/snmptt $OPTIONS snmpttt is running as expected as the zabbix user, the same user which is running the Zabbix server. # ps -ef | grep snmp root 3796 1 0 Jun19 ? 00:13:04 /usr/sbin/snmpd -LS0-6d -Lf /dev/null -p /var/run/snmpd.pid zabbix 4444 1 0 15:00 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon zabbix 4445 4444 0 15:00 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon root 9300 29899 0 15:25 pts/2 00:00:00 grep snmp zabbix 16576 16511 0 Aug16 ? 00:00:11 /path/to/sbin/zabbix_server: snmp trapper [processed data in 0.000007 sec, idle 1 sec] root 16600 1 0 Aug16 ? 00:00:07 /usr/sbin/snmptrapd -A -Lf /var/log/snmptrapd.log -D -p /var/run/snmptrapd.pid The log file to send traps caught is /var/tmp/zabbixtest/zabbix_traps.tmp # egrep "^(log_file|pid)" /etc/snmp/snmptt.ini pid_file = /var/run/snmptt/snmptt.pid log_file=/var/tmp/zabbixtest/zabbix_traps.tmp However, the trap log file is being written to, and owned by the root user, not as the zabbix user as expected. Moreover, the permissions on the file are 0640, meaning that the zabbix user running the server is not able to read the file. # service snmptt stop Stopping snmptt: [ OK ] # rm /var/tmp/zabbixtest/zabbix_traps.tmp rm: remove regular file `/var/tmp/zabbixtest/zabbix_traps.tmp'? y # ls -lia /var/tmp/zabbixtest/zabbix_traps.tmp ls: cannot access /var/tmp/zabbixtest/zabbix_traps.tmp: No such file or directory # ls -lia /var/tmp/zabbixtest/ total 24 263224 drwxrwxr-x 2 root zabbix 4096 Aug 17 15:32 . 262145 drwxrwxrwt 7 root root 4096 Aug 17 14:53 .. # service snmptt start Starting snmptt: PID file: /var/run/snmptt/snmptt.pid [ OK ] # ps -ef | grep snmptt zabbix 9944 1 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon zabbix 9945 9944 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon root 9981 29899 0 15:32 pts/2 00:00:00 grep snmptt # ps -ef | grep snmp root 3796 1 0 Jun19 ? 00:13:04 /usr/sbin/snmpd -LS0-6d -Lf /dev/null -p /var/run/snmpd.pid zabbix 9944 1 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon zabbix 9945 9944 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon root 9986 29899 0 15:32 pts/2 00:00:00 grep snmp zabbix 16576 16511 0 Aug16 ? 00:00:11 /path/to/sbin/zabbix_server: snmp trapper [processed data in 0.000079 sec, idle 1 sec] root 16600 1 0 Aug16 ? 00:00:07 /usr/sbin/snmptrapd -A -Lf /var/log/snmptrapd.log -D -p /var/run/snmptrapd.pid # ls -lia /var/tmp/zabbixtest/zabbix_traps.tmp 262265 -rw-r----- 1 root root 122 Aug 17 15:32 /var/tmp/zabbixtest/zabbix_traps.tmp Note the file permissions and ownership of /var/tmp/zabbixtest/zabbix_traps.tmp. Accordingly, the zabbix user is unable to read the file and is hence unable to process it. I can fix by manually modifying the mode of the trap file /var/tmp/zabbixtest/zabbix_traps.tmp to 0644, for example, but I am hoping there is a better way, e.g. via a configuration file, since the file location will most likely change. (There are some blog sites recommending to change the mode to 0777, obviously that is not the correct solution). I guess it is due to the snmptrapd configuration, running as root, but not sure the best way to fix this. **My questions:** Why is the trap log file being written to as the root user with 0640 permissions, instead of as zabbix user running snmptt? How can/should I configure snmptt and/or snmptrapd to have the trap file be owned and readable by the zabbix user instead of root user. **Other relevant info:** snmptrapd config file: # grep -v '^#' /etc/snmp/snmptrapd.conf disableAuthorization yes traphandle default /usr/sbin/snmptthandler Running RHEL 6.6
Asked by hilcharge (359 rep)
Aug 17, 2017, 06:54 AM
Last activity: Jul 19, 2025, 05:00 PM