sudoers: nagios does not get to run dsa-check-backuppg with arbitrary command line...

[dsa-puppet.git] / modules / sudo / files / common / sudoers

diff --git a/modules/sudo/files/common/sudoers b/modules/sudo/files/common/sudoers
index 9ff6f97fc40c7bc7efcdc93289be4e5b2614394a..380c37ea2f314e1e38344cbdfcaa512e47b55f05 100644 (file)
--- a/modules/sudo/files/common/sudoers
+++ b/modules/sudo/files/common/sudoers
@@ -18,11 +18,16 @@
 ###################################################################
 
 Defaults       env_reset
+Defaults       passprompt="[sudo] password for %u on %h: "
 
 # Host alias specification
 Host_Alias     QAHOSTS         = master, merkel
 Host_Alias     WEBHOSTS        = klecker, wolkenstein
 Host_Alias     SECHOSTS        = klecker, chopin
+Host_Alias     ZIVITHOSTS      = zelenka, zandonai
+Host_Alias     AACRAIDHOSTS    = bellini, cimarosa, morricone, paganini, respighi, vivaldi, beethoven, pettersson
+Host_Alias     MEGARAIDHOSTS   = grieg, rautavaara, sibelius
+Host_Alias     MPTRAIDHOSTS    = master, fasch, holter, barber, biber, cilea, vitry, krenek, scelsi, orff, field
 # User alias specification
 User_Alias     QACORE          = aba, djpig, geissert, hertzog, jeroen, joerg, lucas, luk, myon, tbm, weasel, zack
 
@@ -37,7 +42,7 @@ root  ALL=(ALL) ALL
 %adm           ALL=(ALL)       NOPASSWD: /usr/bin/apt-get update, /usr/bin/apt-get dist-upgrade, /usr/bin/apt-get clean, /usr/sbin/samhain -t check -i -p err -s none -l none -m none, /usr/sbin/upgrade-porter-chroots
 
 admin          agnesi=(ALL)    ALL
-%zivit-admins  zelenka=(ALL)   NOPASSWD: ALL
+%zivit-admins  ZIVITHOSTS=(ALL)        NOPASSWD: ALL
 
 # nagios
 nagios         ALL=(ALL)       NOPASSWD: /usr/lib/nagios/plugins/dsa-check-dabackup ""
@@ -50,10 +55,13 @@ nagios              ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=0 pd [0-9]\:[0-9]
 nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=0 pd [0-9]I\:[0-9]\:[0-9] show
 nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=[02] show status
 # other raid controllers
-nagios         master=(ALL)    NOPASSWD: /usr/sbin/mpt-status -s
 nagios         powell=(ALL)    NOPASSWD: /usr/local/sbin/areca-cli vsf info
 nagios         puccini=(ALL)   NOPASSWD: /usr/local/bin/tw_cli info c0 u0 status
-nagios         bellini,cimarosa,morricone,paganini,respighi,vivaldi=(ALL)      NOPASSWD: /usr/local/bin/arcconf GETCONFIG 1 LD, /usr/local/bin/arcconf GETCONFIG 1 AD
+nagios         MPTRAIDHOSTS=(ALL)      NOPASSWD: /usr/sbin/mpt-status -s
+nagios         AACRAIDHOSTS=(ALL)      NOPASSWD: /usr/local/bin/arcconf GETCONFIG 1 LD, /usr/local/bin/arcconf GETCONFIG 1 AD
+nagios         MEGARAIDHOSTS=(ALL)     NOPASSWD: /usr/local/bin/megarc -AllAdpInfo -nolog, /usr/local/bin/megarc -dispCfg -a0 -nolog
+# other nagios things
+nagios         beethoven=(debbackup)   NOPASSWD: /usr/lib/nagios/plugins/dsa-check-backuppg ""
 
 # groups and their role accounts
 %buildd                ALL=(buildd)    ALL
@@ -61,6 +69,7 @@ nagios                bellini,cimarosa,morricone,paganini,respighi,vivaldi=(ALL)      NOPASSWD: /us
 %dde           ALL=(dde)       ALL
 %debadmin      ALL=(dak)       ALL
 %debbugs       ALL=(debbugs)   ALL
+%debian-cd     ALL=(debian-cd) ALL
 %debian-release        ALL=(release)   ALL
 %debwww                ALL=(debwww)    ALL
 %forums                ALL=(forums)    ALL
@@ -104,13 +113,14 @@ pkg_user  powell=(archvsync)      NOPASSWD: /home/archvsync/bin/pushpdo
 # remote power to babylon5 in the same rack:
 joerg          unger=(ALL)             /usr/bin/sispmctl -t 1, /usr/bin/sispmctl -g 1
 # wbadm can update all buildd* users' keys on buildd.d.o
-%wbadm         cimarosa=(root)         /usr/local/bin/update-buildd-sshkeys
-wbadm          cimarosa=(postgres)     NOPASSWD: /usr/bin/pg_dumpall --cluster 8.4/wanna-build
+%wbadm         cimarosa,grieg=(root)           /usr/local/bin/update-buildd-sshkeys
+wbadm          cimarosa,grieg=(postgres)       NOPASSWD: /usr/bin/pg_dumpall --cluster 8.4/wanna-build
 # mirror push
 dak            ries=(archvsync)        NOPASSWD:/home/archvsync/runmirrors
 planet         senfl=(archvsync)       NOPASSWD: /home/archvsync/bin/runplanet ""
 # archvsync triggers snapshot
 archvsync      stabile=(snapshot)      NOPASSWD: /srv/snapshot.debian.org/bin/update-trigger
+archvsync      sibelius=(snapshot)     NOPASSWD: /srv/2ndsnapshot/bin/update-trigger
 # dak stuff
 %debian-release        ries=(dak)              /usr/local/bin/dak transitions --import *
 %ftpteam       ries=(dak)              /usr/local/bin/dak transitions --import *
@@ -130,3 +140,14 @@ debwww             WEBHOSTS=(archvsync)    NOPASSWD: /home/archvsync/webmirrors/runmirrors
 # geodns may reload bind
 geodnssync     geo1,geo2,geo3=(root)   NOPASSWD: /etc/init.d/bind9 reload
 geodnssync     geo1,geo2,geo3=(root)   NOPASSWD: /usr/sbin/rndc reconfig
+
+# Porter work
+%porter-alpha  albeniz=(root)          NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-armel  agricola=(root)         NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-amd64  pergolesi=(root)        NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-hppa   paer=(root)             NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-ia64   merulo=(root)           NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-mips   gabrielli=(root)        NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-ppc    pescetti=(root)         NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-s390   zelenka=(root)          NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-sparc  smetana,sperger,zee=(root)      NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot