Cmnd_Alias LF_NAGIOS = /usr/lib64/nagios/plugins/about-me,\
                    /usr/lib64/nagios/plugins/borgbackup,\
                    /usr/lib64/nagios/plugins/deb-updates,\
                    /usr/lib64/nagios/plugins/dhcp-relayed,\
                    /usr/lib64/nagios/plugins/disk-smart,\
                    /usr/lib64/nagios/plugins/disk-usage,\
                    /usr/lib64/nagios/plugins/dmesg,\
                    /usr/lib64/nagios/plugins/docker-container,\
                    /usr/lib64/nagios/plugins/docker-image,\
                    /usr/lib64/nagios/plugins/docker-info,\
                    /usr/lib64/nagios/plugins/docker-stats,\
                    /usr/lib64/nagios/plugins/fail2ban,\
                    /usr/lib64/nagios/plugins/file-age,\
                    /usr/lib64/nagios/plugins/file-size,\
                    /usr/lib64/nagios/plugins/ipmi-sel,\
                    /usr/lib64/nagios/plugins/ipmi-sensor,\
                    /usr/lib64/nagios/plugins/journald-query,\
                    /usr/lib64/nagios/plugins/journald-usage,\
                    /usr/lib64/nagios/plugins/kdump,\
                    /usr/lib64/nagios/plugins/kvm-vm,\
                    /usr/lib64/nagios/plugins/logfile,\
                    /usr/lib64/nagios/plugins/mastodon-version,\
                    /usr/lib64/nagios/plugins/mysql-logfile,\
                    /usr/lib64/nagios/plugins/needs-restarting,\
                    /usr/lib64/nagios/plugins/network-bonding,\
                    /usr/lib64/nagios/plugins/nextcloud-app-updates,\
                    /usr/lib64/nagios/plugins/nextcloud-enterprise,\
                    /usr/lib64/nagios/plugins/nextcloud-security-scan,\
                    /usr/lib64/nagios/plugins/nextcloud-version,\
                    /usr/lib64/nagios/plugins/openvpn-client-list,\
                    /usr/lib64/nagios/plugins/path-rw-test,\
                    /usr/lib64/nagios/plugins/php-status,\
                    /usr/lib64/nagios/plugins/podman-container,\
                    /usr/lib64/nagios/plugins/podman-image,\
                    /usr/lib64/nagios/plugins/podman-info,\
                    /usr/lib64/nagios/plugins/podman-stats,\
                    /usr/lib64/nagios/plugins/restic-check,\
                    /usr/lib64/nagios/plugins/restic-snapshots,\
                    /usr/lib64/nagios/plugins/restic-stats,\
                    /usr/lib64/nagios/plugins/scanrootkit,\
                    /usr/lib64/nagios/plugins/strongswan-connections,\
                    /usr/lib64/nagios/plugins/systemd-unit

# librenms-validate does not run as root. LibreNMS refuses to validate itself as root, so
# the check runs its validation as the LibreNMS user instead. Every command below is
# listed with the exact arguments the check uses: a trailing wildcard would hand the
# LibreNMS user a PHP interpreter with free arguments, which is arbitrary code execution
# under that account. Adjust the paths here if the installation does not live in
# /opt/librenms or PHP is not at /usr/bin/php, and pass the same values to the check via
# --path and --php-path.
Cmnd_Alias LF_LIBRENMS_VALIDATE = /usr/bin/php /opt/librenms/validate.php -s,\
                    /usr/bin/php /opt/librenms/validate.php -s -g distributedpoller,\
                    /usr/bin/php /opt/librenms/validate.php -s -g mail,\
                    /usr/bin/php /opt/librenms/validate.php -s -g rrdcheck

Defaults:icinga !requiretty, !pam_session
Defaults!LF_NAGIOS !syslog
Defaults!LF_LIBRENMS_VALIDATE !syslog

icinga ALL = NOPASSWD: LF_NAGIOS
icinga ALL = (librenms) NOPASSWD: LF_LIBRENMS_VALIDATE

