Check_icmp: Failed to obtain ICMP socket: Operation not permitted

[std (duga)]

Hi,
can somebody help, my server is down und i have this
check_icmp: Failed to obtain ICMP socket: Operation not permitted
What can i make?

[openmindz (Thomas Karatzoglou)]

Hi @std and welcome to the forum!

The check_icmp needs very specific permissions to be executed correctly by a non privileged user. You need to chmod u+s and chmod g+sit. Check this old posting for more details.

HTH,
Thomas

[std (duga)]

HI, thnx but where i need to make this command only as sudo in root or somewhere else?

[openmindz (Thomas Karatzoglou)]

Hi @std

On my instance I can find this particular check in $OMD_ROOT/lib/nagios/plugins. As
far as I can see, the permissions are as follows:

-rwxr-x--- 1 root omd 269480 Apr 14 19:08 check_icmp*

Owner is root, group is omd. In my installation, the setuid bit isn’t set, but it probably works because it’s owned by root. Try finding out where your check_icmp plugin is located and inspect its permissions.

HTH,
Thomas

[gulaschcowboy (AlexW)]

Hi everybody,

in modern versions of Checkmk these permissions are not handled by the setuid-root anymore but by capabilities.

Check for the capabilities of check_icmp by running:
getcap check_icmp
it should have:
check_icmp = cap_net_raw+ep

if not, set it with setcap:
setcap cap_net_raw+ep check_icmp

[openmindz (Thomas Karatzoglou)]

Interesting @gulaschcowboy,

thanks for that insight, because I’ll openly admit, I didn’t know that. Indeed, my check_icmp executable has the capabilities you mention.

EDIT P.S.: I verified this with a 1.6.0p22 and a 2.0.0p2 instance.