[Feature]: Pre and post actions for patching
What is the installation method of your PatchMon server?
Docker
What is the version of your PatchMon server?
2.0.2
Briefly describe the feature
Execute script or command before or after patching host
Detailed description
Extend patching policies with actions feature and fields for "script to run before/after patching" with optional and or default settings for "timeout in seconds", "command modes" like must succeed, ignore failures, run asynchronously - ignore failures.
Why is this useful?
To stop, start, restart service, activate or disable maintenance of cluster nodes (for example in docker swarm or ceph cluster), and much more what needed or want.
9 Comments
It should always be done through sudo in my opinion. Sudo rights can be used also using in combination with the NOPASSWORD setting in /etc/sudoers.
And yes, sudo is the same as if you're executing it as root user.
I agree on this feature, for like executing some scripts or doing before or after patching process work. Possibly configurable through a template or per-server pre/post action.
@EiTiFuzzi Hi, thanks for raising. Are you able to close the duplicate please? You should be able to.
Duplicate marked and closed
@EiTiFuzzi Hi, thanks for raising. Are you able to close the duplicate please? You should be able to.
duplicated
Running the agent without root rights is a good idea. But, if the agent user can get the root right with sudo for any command, is it the same as run on root user?
Hi Iby, thanks for your great work with patchmon. A tool I ever looked for. simple chance to keep a bench of servers up to date. I will wait for the new features...
Thanks a lot
·5 months agoYes - this I also mentioned yesterday however I want to add this upon next few releases.
So far every command done by the agent is hard coded to avoid ambiguous commands being ran.
So I do want to make sure the agent runs as non-root as default before implementing pre and post script.
The other thing is that I have to work out the best way to handle the sudoers file to allow certain commands that run via the agent to be auto-elevated to root upon execution.
So in short, implementation of pre-post scripts is easy however right now it’s not secure way of doing it as the agent runs as root.
Once I give this part of it some time and dedicated attention and testing I will implement pre/post options.
Glad you’re playing with 1.5.0, i’ll be pushing a new update soon which handles notifications logic differently with delayed notifications which will wait for x amount of time before proceeding with notifications.
Thanks for this.
I’m going to merge this into pre and post patching feature requests