EDR Cluster: Cannot start Error: "Incomplete sudo permissions configured for user"
search cancel

EDR Cluster: Cannot start Error: "Incomplete sudo permissions configured for user"

book

Article ID: 291642

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When attempting to start the cluster from the primary server's CLI as non-root user, errors appear: 
Validating privileges on remote nodes.
...
Incomplete sudo permissions configured for user 'edradmin' on host '192.168.1.100'. The user is missing the following 1 sudo privileges:
  1) sudo -n /usr/share/cb/cb-force-shutdown

 

Environment

  • EDR: 7.1.1 and 7.3
  • Clustered Environment

Cause

Specific sudo commands are missing or not enabled for the 'edradmin' user.

Resolution

  1. Fully stop the cluster:
/usr/share/cb/cbcluster stop
  1. Modify /etc/sudoers
  2. Add a new line anywhere in the file, such as the very bottom:
Cmnd_Alias FORCE_SHUTDOWN = /usr/share/cb/cb-force-shutdown
  1. Append "FORCE_SHUTDOWN" to the end of the existing line that begins with the EDR system admin username.  (Example, "edradmin") :
edradmin    ALL=(ALL) NOPASSWD: HOSTNAME, CB_INIT, YUM_INSTALL_CB, YUM_INSTALL_RSYNC, MKDIR_ETC_CB, MKDIR_ETC_CB_CERTS, COPY_ALLIANCE_CRT, COPY_SERVER_CRT, COPY_CLIENT_CA_CRT, COPY_ALLIANCE_KEY, COPY_SERVER_KEY, COPY_CLIENT_CA_KEY, COPY_CB_REPO, COPY_CLUSTER_CONF, COPY_ERLANG_COOKIE, COPY_SERVER_LIC, COPY_SERVER_TOKEN, CBCHECK_IP_TABLES, CB_ENTERPRISE, CAT_VERSION, CBUPGRADE, CBUPGRADE_CHECK
  1. The final line should look similar to:
edradmin ALL=(ALL) NOPASSWD: HOSTNAME, CB_INIT, YUM_INSTALL_CB, YUM_INSTALL_RSYNC, MKDIR_ETC_CB, MKDIR_ETC_CB_CERTS, COPY_ALLIANCE_CRT, COPY_SERVER_CRT, COPY_CLIENT_CA_CRT, COPY_ALLIANCE_KEY, COPY_SERVER_KEY, COPY_CLIENT_CA_KEY, COPY_CB_REPO, COPY_CLUSTER_CONF, COPY_ERLANG_COOKIE, COPY_SERVER_LIC, COPY_SERVER_TOKEN, CBCHECK_IP_TABLES, CB_ENTERPRISE, CAT_VERSION, CBUPGRADE, CBUPGRADE_CHECK, FORCE_SHUTDOWN
  1. Repeat these steps for all nodes in the cluster, primary and minion(s).
  2. Start the cluster:
/usr/share/cb/cbcluster start


 

Additional Information

  • The user "edradmin" is an example name. This user name is determined by the system admin who originally installed EDR, so the name will vary between clusters. 
  • This issue may generally occur when upgrading from an older version of EDR prior to version 7.1.1.
  • These steps should be run on all nodes in the cluster: primary and minions.
Powered by Wolken Software