<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 23. 02. 21 20:29, Mark Moseley via
dnsdist wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAOH1cHncs1m0tX6GWphDv3-bq3BudB+L5eKHTFy0dC4zzebAbw@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">On Tue, Feb 23, 2021 at 7:49 AM Remi Gacogne
via dnsdist <<a
href="mailto:dnsdist@mailman.powerdns.com"
moz-do-not-send="true">dnsdist@mailman.powerdns.com</a>>
wrote:<br>
</div>
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Hi
Aleš,<br>
<br>
On 2/23/21 4:35 PM, Aleš Rygl via dnsdist wrote:<br>
> My idea was that changing mode of agentx directory
above to 755 could <br>
> help but it is not like that. I had to force
dnsdist to run with root <br>
> privileges to make it work again.<br>
> <br>
> What should be the correct setup to run dnsdist
under _dnsdist account <br>
> again and SNMP enabled?<br>
<br>
I _think_ you should be able to change the permissions
on the directory <br>
once, and it should stay that way, but you probably also
need to set the <br>
permissions on the socket itself. The documentation [1]
states that you <br>
can do that in snmpd.conf, and our own CI actually does:<br>
<br>
agentxperms 0700 0755<br>
<br>
Which should set the socket permissions to 0700 and the
directory <br>
permissions to 0755. So if the socket is owned by
_dnsdist, I think that <br>
should work:<br>
<br>
agentxperms 0700 0755 _dnsdist _dnsdist<br>
<br>
</blockquote>
<div><br>
</div>
<div>Or if you need to play nice with other things on the
system (maybe other subagents are running):</div>
<div><br>
</div>
<div>agentxperms 0770 0770 root agentxusers</div>
<div><br>
</div>
<div>and create a unix group called 'agentxusers' with
_dnsdist in it (and then you can add other users
requiring subagent access to that group)</div>
</div>
</div>
</div>
</div>
<br>
</blockquote>
<p>Hi Remi, <br>
</p>
<p>Thanks for your immediate response. It works like a magic! Now I
remember there were such options in snmd.conf. I should have read
the documentation more carefully before asking :-) The only thing
I can say to my apology is that there was no need to touch
previous version for more than eight months! Amazing!</p>
<p>@Mark, thanks. I was also considering this option.</p>
<p>Cheers</p>
<p>Ales<br>
</p>
</body>
</html>