"Icinga JEA run external scripts"

Icinga 2 Automation & Infrastructure
1

Hello everyone,

I have installed Icinga JEA. It works well so far. However, I still have PowerShell scripts that are no longer working. One error message says: Get-ChildItem: Access to the path “D:\Logfiles” was denied. I am grateful for any tips

Kind regards

Stefan

2

That is the whole point of JEA. it gives you "Just Enough Administration (JEA)
Specific permissions and commands in Powershell are given to the profile/process/user nothing more.

One obviouse solution would be to generate your own check plugins package. install it and regenerate the jea profile.

Can’t promise anything but this looks promising:

Over the course of a day, you will learn how to install and automatically roll out Icinga for Windows, how to troubleshoot common issues, how to build your own repository to distribute packages on your own terms, and how to write a first custom plugin module.

I did that using the docs, but there is a learning curve.

But you can try not to use the powershell framework service. since the icinga2 agent can natively execute anything

Untested
You could empower the icinga2 user with the necessary priviliges and run the in an non-powershell way.

  • translate it to pure go and compile a binary
  • translate it to python3 and use the python to execute
  • compile it it to binary using any language except powershell
  • rewrite it to pure vbs and use wscript.exe