incorrect filesystem permissions prevent nagios command checking from working

[agent 8131]

Binary package hint: nagios3

Once external command checking has been enabled in nagios.cfg the following error message is reported when attempting to use external commands:

---
Error: Could not stat() command file '/var/lib/nagios3/rw/nagios.cmd'!

The external command file may be missing, Nagios may not be running, and/or Nagios may not be checking external commands.

An error occurred while attempting to commit your command for processing.
---

Reported on several websites are the following steps to resolve the problem:

---
sudo /etc/init.d/nagios3 stop
sudo dpkg-statoverride --update --add nagios www-data 2710 /var/lib/nagios3/rw
sudo dpkg-statoverride --update --add nagios nagios 751 /var/lib/nagios3
sudo /etc/init.d/nagios3 start
---

These filesystem permissions should be the default unless there is a compelling reason not to or a more secure solution to this problem.

Websites offering this solution:

---
* http://www.idimmu.net/2009/03/31/Error:-Could-not-stat()-command-file-%27/var/lib/nagios3/rw/nagios.cmd%27!
* https://blog.devnu11.net/2008/04/nagios3-debian-etch-pakete/
* http://lars-schenk.com/nagios-commands-via-web-interface-on-debian/446
* http://yesthatworks.blogspot.com/2008/11/error-could-not-stat-command-file_26.html
---

[Thierry Carrez (ttx)]

This is done in the Debian package as a "security feature", as documented in /usr/share/doc/nagios3/README.Debian
See also http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=478889

[richard hill (ric-j-hill)]

Hi what exactly do these lines do?

sudo dpkg-statoverride --update --add nagios www-data 2710 /var/lib/nagios3/rw
sudo dpkg-statoverride --update --add nagios nagios 751 /var/lib/nagios3

[Daryl Lublink (dlublink)]

A much easier fix to this button is to add www-data to the nagios group.

I did it by editing /etc/group and added www-data to the line starting with nagios.

I restarted apache, and the error is gone.

[agent 8131 (agent-8131)]

Yes, adding www-data to the nagios group is an easy fix. It also carries grave security implications. Use at your own risk.