starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Permission issues on hardened server. #5840

New Issue
Closed
opened 2025-12-29 19:33:23 +01:00 by adam · 1 comment
adam commented 2025-12-29 19:33:23 +01:00
Owner
Copy Link

Originally created by @joubbi on GitHub (Dec 28, 2021).

NetBox version

v3.1.2

Python version

3.9

Steps to Reproduce

  1. Install RHEL 8.5
  2. Harden it with https://github.com/dev-sec/ansible-collection-hardening
  3. Install Netbox according to https://netbox.readthedocs.io/en/stable/installation

Expected Behavior

The installation should succeed.

Observed Behavior

The netbox.service does not start due to permission problems.

$ sudo systemctl status netbox
[sudo] password for user01: 
● netbox.service - NetBox WSGI Service
   Loaded: loaded (/etc/systemd/system/netbox.service; enabled; vendor preset: disabled)
   Active: activating (auto-restart) (Result: exit-code) since Tue 2021-12-28 16:20:48 CET; 1s ago
     Docs: https://netbox.readthedocs.io/en/stable/
  Process: 32199 ExecStart=/opt/netbox/venv/bin/gunicorn --pid /var/tmp/netbox.pid --pythonpath /opt/netbox/netbox --config /opt/netbox/gunicorn.py netbox.wsgi (code=exited, status=203/EXEC)
 Main PID: 32199 (code=exited, status=203/EXEC)

Dec 28 16:20:48 rhel8-hardened.company.lan systemd[1]: netbox.service: Failed with result 'exit-code'.

Dec 28 15:55:17 rhel8-hardened systemd[31508]: netbox-rq.service: Failed to execute command: Permission denied
Dec 28 15:55:17 rhel8-hardened systemd[31508]: netbox-rq.service: Failed at step EXEC spawning /opt/netbox/venv/bin/python3: Permission denied
Dec 28 15:55:17 rhel8-hardened systemd[31509]: netbox.service: Failed to execute command: Permission denied
Dec 28 15:55:17 rhel8-hardened systemd[31509]: netbox.service: Failed at step EXEC spawning /opt/netbox/venv/bin/gunicorn: Permission denied
Dec 28 15:55:17 rhel8-hardened systemd[1]: netbox-rq.service: Main process exited, code=exited, status=203/EXEC
Dec 28 15:55:17 rhel8-hardened systemd[1]: netbox-rq.service: Failed with result 'exit-code'.
Dec 28 15:55:17 rhel8-hardened systemd[1]: netbox.service: Main process exited, code=exited, status=203/EXEC
Dec 28 15:55:17 rhel8-hardened systemd[1]: netbox.service: Failed with result 'exit-code'.

I understand that this is due to the file permissions set to be very restrictive by the hardening of the system:

total 36
drwx------.  9 root   root  248 Dec 28 14:50 circuits
drwx------. 11 root   root 4096 Dec 28 14:50 dcim
drwx------. 12 root   root 4096 Dec 28 14:50 extras
-rwx------.  1 root   root  277 Dec 28 14:36 generate_secret_key.py
drwx------. 11 root   root 4096 Dec 28 14:50 ipam
-rwx------.  1 root   root  249 Dec 28 14:36 manage.py
drwx------.  4 netbox root   56 Dec 28 14:36 media
drwx------.  8 root   root 4096 Dec 28 14:50 netbox
drwx------.  8 root   root  259 Dec 28 14:36 project-static
drwx------.  2 root   root   25 Dec 28 14:36 reports
drwx------.  2 root   root   25 Dec 28 14:36 scripts
drwx------. 11 root   root 4096 Dec 28 14:50 static
drwx------. 18 root   root 4096 Dec 28 14:36 templates
drwx------.  9 root   root  230 Dec 28 14:50 tenancy
drwx------.  7 root   root  222 Dec 28 14:50 users
drwx------.  9 root   root 4096 Dec 28 14:50 utilities
drwx------.  8 root   root  233 Dec 28 14:50 virtualization
drwx------.  8 root   root  287 Dec 28 14:50 wireless

The service starts if I modify /etc/systemd/system/netbox.serviceand change user=netbox to user=root.
But this is a bad idea and not the proper way to solve this.

I understand that my system is not like most other newly installed EL8 systems, but I think that the proper/needed file permissions should be documented or preferably set by the upgrade script upgrade.sh.

Originally created by @joubbi on GitHub (Dec 28, 2021). ### NetBox version v3.1.2 ### Python version 3.9 ### Steps to Reproduce 1. Install RHEL 8.5 2. Harden it with https://github.com/dev-sec/ansible-collection-hardening 3. Install Netbox according to https://netbox.readthedocs.io/en/stable/installation ### Expected Behavior The installation should succeed. ### Observed Behavior The netbox.service does not start due to permission problems. ``` $ sudo systemctl status netbox [sudo] password for user01: ● netbox.service - NetBox WSGI Service Loaded: loaded (/etc/systemd/system/netbox.service; enabled; vendor preset: disabled) Active: activating (auto-restart) (Result: exit-code) since Tue 2021-12-28 16:20:48 CET; 1s ago Docs: https://netbox.readthedocs.io/en/stable/ Process: 32199 ExecStart=/opt/netbox/venv/bin/gunicorn --pid /var/tmp/netbox.pid --pythonpath /opt/netbox/netbox --config /opt/netbox/gunicorn.py netbox.wsgi (code=exited, status=203/EXEC) Main PID: 32199 (code=exited, status=203/EXEC) Dec 28 16:20:48 rhel8-hardened.company.lan systemd[1]: netbox.service: Failed with result 'exit-code'. ``` ``` Dec 28 15:55:17 rhel8-hardened systemd[31508]: netbox-rq.service: Failed to execute command: Permission denied Dec 28 15:55:17 rhel8-hardened systemd[31508]: netbox-rq.service: Failed at step EXEC spawning /opt/netbox/venv/bin/python3: Permission denied Dec 28 15:55:17 rhel8-hardened systemd[31509]: netbox.service: Failed to execute command: Permission denied Dec 28 15:55:17 rhel8-hardened systemd[31509]: netbox.service: Failed at step EXEC spawning /opt/netbox/venv/bin/gunicorn: Permission denied Dec 28 15:55:17 rhel8-hardened systemd[1]: netbox-rq.service: Main process exited, code=exited, status=203/EXEC Dec 28 15:55:17 rhel8-hardened systemd[1]: netbox-rq.service: Failed with result 'exit-code'. Dec 28 15:55:17 rhel8-hardened systemd[1]: netbox.service: Main process exited, code=exited, status=203/EXEC Dec 28 15:55:17 rhel8-hardened systemd[1]: netbox.service: Failed with result 'exit-code'. ``` I understand that this is due to the file permissions set to be very restrictive by the hardening of the system: ```# ls -l /opt/netbox/netbox/ total 36 drwx------. 9 root root 248 Dec 28 14:50 circuits drwx------. 11 root root 4096 Dec 28 14:50 dcim drwx------. 12 root root 4096 Dec 28 14:50 extras -rwx------. 1 root root 277 Dec 28 14:36 generate_secret_key.py drwx------. 11 root root 4096 Dec 28 14:50 ipam -rwx------. 1 root root 249 Dec 28 14:36 manage.py drwx------. 4 netbox root 56 Dec 28 14:36 media drwx------. 8 root root 4096 Dec 28 14:50 netbox drwx------. 8 root root 259 Dec 28 14:36 project-static drwx------. 2 root root 25 Dec 28 14:36 reports drwx------. 2 root root 25 Dec 28 14:36 scripts drwx------. 11 root root 4096 Dec 28 14:50 static drwx------. 18 root root 4096 Dec 28 14:36 templates drwx------. 9 root root 230 Dec 28 14:50 tenancy drwx------. 7 root root 222 Dec 28 14:50 users drwx------. 9 root root 4096 Dec 28 14:50 utilities drwx------. 8 root root 233 Dec 28 14:50 virtualization drwx------. 8 root root 287 Dec 28 14:50 wireless ``` The service starts if I modify `/etc/systemd/system/netbox.service`and change `user=netbox` to `user=root`. But this is a bad idea and not the proper way to solve this. I understand that my system is not like most other newly installed EL8 systems, but I think that the proper/needed file permissions should be documented or preferably set by the upgrade script `upgrade.sh`.
adam closed this issue 2025-12-29 19:33:23 +01:00
adam commented 2025-12-29 19:33:24 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Dec 28, 2021):

If you alter the default permissions of the system, you'll also need to modify the steps provided in the NetBox documentation to accommodate the changes you made, or revert them. This is not something the NetBox documentation can or should address.

@jeremystretch commented on GitHub (Dec 28, 2021): If you alter the default permissions of the system, you'll also need to modify the steps provided in the NetBox documentation to accommodate the changes you made, or revert them. This is not something the NetBox documentation can or should address.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#5840
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?