0

I'm on a Cent 5.10 host.

I am issuing remote commands to this host to start services, every service reads as a success for starting:

kkahn@host: /home/kkahn$ ssh -q -t host.example.com "sudo /etc/init.d/redacted-service start "
Starting service
Service started
Connection to host.example.com closed.

The PID file is even created under /var/run with a PID entry, but there is no process started! If I run the command with a sleep 10 at the end it will run the process on the remote host for 10 seconds and stop when the command has ended.

7
  • If you ssh to the server (interactive session) and then manually start the service and then logout, do you have the same issue?
    – xhienne
    Feb 24, 2021 at 23:03
  • Nope! This is only when running the start commands remotely.
    – Kahn
    Feb 24, 2021 at 23:50
  • Yes that was the first thing I did, but they are not logging anything useful. I don't see messages even showing the process at all. It just shows my ssh connection. I don't know what to turn up to increase any verbosity.
    – Kahn
    Feb 25, 2021 at 0:01
  • "I don't see messages even showing the process at all" => This is highly suspicious. Are you using systemd for your services? If so, see what journalctl displays.
    – xhienne
    Feb 25, 2021 at 0:10
  • I'm on CentOS 5.10.
    – Kahn
    Feb 25, 2021 at 0:13

1 Answer 1

2

After sudo -i and checking the output of set on both a host that doesn't work and one that does (a Cent5 box compared to Cent6), I noticed the following:

[root@cent5-node ~]# set | grep -i sudo
SUDO_COMMAND=/bin/bash
SUDO_GID=100100017
SUDO_UID=100100017
SUDO_USER=kkahn

[root@cent6-node ~]# set | grep -i sudo
SUDO_COMMAND=/bin/bash
SUDO_GID=1001000173
SUDO_UID=1001000173
SUDO_USER=kkahn
[root@testcentsix(testcentsix) ~]# 

My SUDO_GID and SUDO_UID are correct on cent6-node - and shortened on cent5-node! On Cent5 the IDs have the 3 removed.

As it turns out, this is something that was patched in later releases of sudo:

https://gratisoft.us/sudo/changes.html

    * plugins/sudoers/env.c, plugins/sudoers/ldap.c:
    Use MAX_UID_T_LEN + 1 for uid/gid buffers, not MAX_UID_T_LEN to
    prevent potential truncation. Bug #562.
    [29d9fc4e0c4e]

The version of sudo running on these Cent5 hosts is 1.7.2p1, whereas our Cent6 hosts have 1.8.6p3. After looking through the source code of 1.7.2p1, I sure enough found:

...
char idbuf[MAX_UID_T_LEN];
...

After installing a later version of sudo on the Cent5 node, this problem has been resolved.

Not the answer you're looking for? Browse other questions tagged .