I can’t figure out how to debug this issue of the setcap plugin failing:
zeek@zeekmgr:~$ broctl install
setcap plugin: executing setcap on each node:
10.0.1.12 - Executing setcap: FAIL:
Zeek: v2.6.1 installed from source into /usr/local/bro
Plugins: af_packet installed from source and PingTrip/broctl-setcap setcap.py file installed by hand into /usr/local/bro/lib/broctl/plugins.
The following is appended to the bottom /usr/local/bro/etc/broctl.cfg:
setcap.command=sudo /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/bro && sudo /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/capstats
And this to /etc/sudoers.d/zeek on each of the sensors:
Cmnd_Alias BRO_SETCAP = /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/bro
Cmnd_Alias CAPSTATS_SETCAP = /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/capstats
bro ALL=NOPASSWD: BRO_SETCAP, CAPSTATS_SETCAP
Any ideas what to check to see what is going wrong?