I have a local user account, added to the HACLIENT group, trying to log onto HAWK interface. Authentication is accepted, but I receive the error, “Error invoking /usr/sbin/cibadmin -Ql: Password: sh: cibadmin: command not found”. From the bash prompt as the local user, I can see the entire cib using the command, /usr/sbin/cibadmin -Q --local, so I don’t suspect it’s a privilege issue
And yet, I’m seeing the error above which implies insufficient privilege. The configuration manual tells us to use a non-root user, added to the haclient group, which I have done. This used to work prior to the openSUSE Leap 15.5 upgrade, so I’m not sure if something got broken here. Looking for guidance. NOTE: I can successfully log on with the system account, hacluster, after changing its password, and manage the cluster via HAWK without issue. It is a system account and only belongs to the haclient group. My local user belongs to users as well as haclient. I tried to create a separate system ‘Test’ account and add it to the haclient group, but the result still gives me the same error.
System config - AMD Ryzen 7 5700G, openSUSE Leap 15.5, patched as of 11/2/24, Mate desktop, firefox browser, 32GB RAM, crap-ton of available diskspace. Pacemaker is
Doesn’t look like a privilege issue to me, it looks like the command’s not in the path for the used the program is running as.
That’s what I’d look at to start. /usr/sbin is usually privileged programs for root, though, but check to see what the user who’s running the program invoking the command has in their path.
It likely lies. It does not invoke /usr/sbin/cibadmin, it invokes cibadmin:
out, err, status = Util.run_as(user, pass, 'cibadmin', '-Ql')
It depends on the exact version, but Hawk oscillated between invoking commands as root and invoking commands as the authenticated user. You may have hit such change.
Anyway, the right workaround is to add /usr/sbin to your user’s $PATH. You may consider bug report, because at least the error message does not match what Hawk actually does and is misleading.
There is no such group (or, better, such group is not used by Hawk). Do not add to confusion by arbitrary changing spelling.
In my opinion the more because adding /usr/sbin in a normal user’s PATH variable is not something to be recommended (else it would already have been there in the first place).
I discovered some updates to hawk2. I’m applying them to determine whether the issue has already been resolved. I’ll update the bug report accordingly.