Configure Non-Root Users Privileges

The following subsections explain the procedure to configure non-root user privileges.

To enable data collection, you can configure a non-root user with or without sudo privileges for limited, specific command permissions. This ensures the necessary commands can run without requiring a password.

Qualys recommends configuring a non-root user with sudo privileges for the Qualys Agent, as very few QIDs in Vulnerability Management require root privileges. However, the QIDs that do need root privileges are likely to result in False negatives if the user does not have the necessary privileges.

Non-Root User (Without Sudo)

The following are the steps to configure a non-root user with limited command permissions or to allow selected commands only. Perform the following steps to enable data collection and configure a non-root user to run the necessary commands without requiring a password.

Create a Restricted Command Directory:
Create a directory to house allowed commands, e.g., /opt/limited_access, and link the required commands to this directory:
Command to Create Restricted Command Directory
```
      ln -sf /usr/bin/rpm /opt/limited_access/rpm
      ln -sf /usr/bin/cat /opt/limited_access/cat
      
```
Update the User's PATH Environment:
Edit the .bashrc file for the non-root user (e.g., /home/scanuser/.bash_profile) and add the following line:
Command to update user's PATH environment
```
PATH=/opt/limited_access
export PATH
      
```
This ensures that the shell searches the directories in the specified order when executing commands.

Configure the Cloud Agent:
Use the following commands to configure the Cloud agent with the non-root user.

Command to provision new Cloud Agent


/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh ActivationId="XXXXXXX-XXX-XXX-XXXX-XXXXXXXXX" CustomerId="XXXXXXX-XXX-XXX-XXXX-XXXXXXXXX" UseSudo=0 User=scanuser Group=scanuser

Command for existing Cloud Agent


/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh UseSudo=0 User=scanuser Group=scanuser

Cloud Agent only executes commands linked in the /opt/limited_access/ directory. Any command not present in this directory results in a Command not found error.

Non-Root User (With Sudo)

To enable data collection with sudo privileges, configure the non-root user with sudo permissions to run the necessary commands via sudo without a password. Follow these steps:

Create a Restricted Command Directory:
Create a directory to house allowed commands, e.g., /opt/limited_access, and link the required commands to this directory.
Command to Create Restricted Command Directory
```
      ln -sf /usr/bin/rpm /opt/limited_access/rpm
      ln -sf /usr/bin/cat /opt/limited_access/cat
      
```
Modify the Sudoers File:
Grant the non-root user sudo privileges by creating a file /etc/sudoers.d/scanuser and adding the following content.
Modify /etc/sudoers.d/scanuser File With Following Paramters
```
      Defaults:scanuser    secure_path = /opt/limited_access/
      scanuser ALL = (ALL)  NOPASSWD: ALL
      
```

Configure the Cloud Agent:
Use the following commands to configure the agent with sudo privileges.

Command to provision new Cloud Agent


/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh ActivationId="XXXXXXX-XXX-XXX-XXXX-XXXXXXXXX" CustomerId="XXXXXXX-XXX-XXX-XXXX-XXXXXXXXX" UseSudo=1 User=scanuser Group=scanuser

Command for existing Cloud Agent


      /usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh UseSudo=1 User=scanuser Group=scanuser

Cloud Agent only executes commands linked in the /opt/limited_access/ directory. Any command not present in this directory results in a Command not found error.

Cloud Agent Sudo Commands

The Cloud Agent uses multiple methods to collect metadata to provide asset inventory, vulnerability management, and policy compliance use cases. Some of these methods include running commands to collect list of installed applications and versions, running processes, network interfaces, and so on.

The list of commands is generally static but may change as new vulnerabilities require additional metadata to be collected using other commands. One example is the Meltdown/Spectre vulnerabilities that require specific new commands provided by operating system vendors to collect processor and BIOS information.

To learn more about the Cloud Agent Sudo Commands refer to Cloud Agent Sudo Commands.