setcap plugin failing

Zeek
1

I can’t figure out how to debug this issue of the setcap plugin failing:

zeek@zeekmgr:~$ broctl install
…
setcap plugin: executing setcap on each node:
10.0.1.12 - Executing setcap: FAIL:
…

Details::

OS: Debian9
Zeek: v2.6.1 installed from source into /usr/local/bro
Plugins: af_packet installed from source and PingTrip/broctl-setcap setcap.py file installed by hand into /usr/local/bro/lib/broctl/plugins.

The following is appended to the bottom /usr/local/bro/etc/broctl.cfg:

Configure broctl-setcap plugin

setcap.enabled=1
setcap.command=sudo /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/bro && sudo /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/capstats

And this to /etc/sudoers.d/zeek on each of the sensors:

Cmnd_Alias BRO_SETCAP = /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/bro

Cmnd_Alias CAPSTATS_SETCAP = /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/capstats
bro ALL=NOPASSWD: BRO_SETCAP, CAPSTATS_SETCAP
Defaults!/sbin/setcap !requiretty

Any ideas what to check to see what is going wrong?

2

Is the account you are using zeek or bro? your prompt says zeek but
the sudoers file says bro.

3

Thanks Justin. I stared at those configs for a long time and never noticed the problem. That should fix it.