Keepalived_vrrp: Unsafe permissions found for script 'xxx.sh' - disabling

General questions
1

Hi,

I got a problem when using vrrp with health-check script, the log is as follows:

Keepalived_vrrp[10096]:Starting SNMP subagent
Keepalived_vrrp[10096]:NET-SNMP version 5.7.3 AgentX subagent connected
**Keepalived_vrrp[10096]:Unsafe permissions found for script '/config/scripts/vrrp-check.sh' - disabling.**
**Keepalived_vrrp[10096]:Disabling track script** healthcheck_OUTERSIDE due to insecure
Keepalived_vrrp[10096]:Registering gratuitous ARP shared channel
...

This issue said it should set ‘enable_script_security’ in global_defs section in keepalived.conf, but it does not work. My configuration of global_defs is as follows:

global_defs {
    dynamic_interfaces
    script_user root
    enable_script_security
    notify_fifo /run/keepalived_notify_fifo
    notify_fifo_script /usr/libexec/vyos/system/keepalived-fifo.py
}

VRRP configuration is as follows:
Master node:
group INSIDE {
    interface eth2
    no-preempt
    priority 200
    virtual-address 10.1.4.3/24
    vrid 20
}
group OUTERSIDE {
    health-check {
        failure-count 1
        interval 30
        script /config/scripts/vrrp-check.sh
    }
    interface eth1
    no-preempt
    priority 200
    transition-script {
        backup /config/scripts/dmvpn-backup.sh
        fault /config/scripts/dmvpn-backup.sh
        master /config/scripts/dmvpn-master.sh
    }
    virtual-address 33.1.4.6/24
    vrid 10
}
sync-group MAIN {
    member INSIDE
    member OUTERSIDE
}

backup node:
group INSIDE {
    interface eth2
    no-preempt
    priority 50
    virtual-address 10.1.4.3/24
    vrid 20
}
group OUTSIDE {
    health-check {
        failure-count 1
        interval 30
        script /config/scripts/vrrp-check.sh
    }
    interface eth1
    no-preempt
    priority 50
    transition-script {
        backup /config/scripts/dmvpn-backup.sh
        fault /config/scripts/dmvpn-backup.sh
        master /config/scripts/dmvpn-master.sh
    }
    virtual-address 33.1.4.6/24
    vrid 10
}
sync-group MAIN {
    member INSIDE
    member OUTSIDE
}

ls -al /config/scripts
-rwxr-xr-x 1 root vyattacfg 24 Feb 23 02:10 dmvpn-backup.sh
-rwxr-xr-x 1 root vyattacfg 131 Feb 23 06:46 dmvpn-master.sh
-rwxr-xr-x 1 root vyattacfg 254 Feb 23 08:24 vrrp-check.sh
-rwxr-xr-x 1 root vyattacfg 230 Jan 26 04:29 vyos-postconfig-bootup.script

vyos version:vyos-1.3-beta-202101260443-amd64

The scripts work fine with command mode. Really appreciate if you have any ideas.

Best regards,
Arvin

3

I test the latest 1.3 which is built from souce code, it has the same problem.

4

It looks like the transition-script works fine but health-check script is not.

5

Please ignore this issue, the program works fine.

6

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.