EDR Cluster: Newly added minion cannot start Error: "Incomplete sudo permissions configured for user"
search cancel

EDR Cluster: Newly added minion cannot start Error: "Incomplete sudo permissions configured for user"

book

Article ID: 292016

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Cluster startup as a non-root user fails with error 
Incomplete sudo permissions configured for user 'edradmin' on host '192.168.1.100'. The user is missing the following 1 sudo privileges:
  1) sudo -n /usr/share/cb/cb-force-shutdown
  • Minion's /etc/sudoers file contains permissions to run cb-force-shutdown
  • /usr/share/cb/cb-force-shutdown is not present on the minion

Environment

  • EDR Server: 7.3 and below
  • Clustered Environment

Cause

  • Minion was installed with version 7.4 or greater which does not use this file
  • Minion is running a version that does not match the rest of the cluster

Resolution

  1. Stop Cluster: /usr/share/cb/cbcluster stop
  2. Confirm the version installed on the minion
    1. Run: rpm -qa | grep cb-enterprise
    2. The version listed will match the server version installed. 
Ex. cb-enterprise-7.4.2.210323.1810-1.el7.x86_64 would be EDR server 7.4.2
  1. Uninstall cb-enterprise from the minion following the section "Uninstalling a Server" in the matching version of "VMware Carbon Black EDR Server/Cluster Management Guide" available in the UeX
  2. Remove the node from the cluster: 
    • /usr/share/cb/cbcluster remove-node -N <node_id>
  3. Re-install cb-enterprise on the minion and add the node following the workaround in https://community.carbonblack.com/t5/Knowledge-Base/EDR-Cluster-Cannot-add-minion-when-running-as-non-root-user/ta-p/103905