Skip to main content

NFT001 - Agent Cannot Run nft

Agent error code #NFT001 indicates that nft is present on the host but the agent has no way to run it with the privileges it needs. ModifyingChanging the kernel ruleset requires root, and the agent is neither running as root nor able to escalate.

The agent never hardcodes sudo. When it is not root it looks for a non-interactive escalation tool, preferring doas -n on OpenBSD (where thatsudo is thenot platformin conventionbase) and otherwise sudo -n. everywhere else. This errorcode means neither binary was usable.found at all.

A sudoers or doas rule that exists but refuses the call is a different failure. There the escalation tool runs and nft does not, and the agent reports #NFT400, because from the outside a refusal and a broken nft look the same. Read that page if sudo is installed and this code still appears.

Common causes include:

  • The agent runs as a non-root service account andon noa sudoershost orwith doas rule grants itneither nftsudo nor doas installed
  • Asudo sudoersis ruleinstalled existsoutside butthe requiresPATH the agent process was started with
The agent runs in a password,container soimage stripped down to the non-interactiveagent call fails A sudoers rule exists but is scoped to a different user, command path or hostbinary

Steps to Resolve

GrantLet knocker Configure It

On the Agentagent Non-Interactivehost:

Access
knocker toenable nftnftables
    knocker Createstatus anftables drop-in file,

    enable for examplewrites /etc/sudoers.d/knocknoc-agentagent_nftables,

    Addvalidates ait rulewith forvisudo -cf, creates the accountdefault sets and installs the unit that recreates them at boot. status reports whether the agent runshas as,the permission.

    Or Grant Access by Hand

      Confirm sudo is installed and on the agent's PATH: command -v sudo Create /etc/sudoers.d/knocknoc-agent_nftables with nothe passwordrule prompt:the package ships: 
      knocknocknocknoc-agent ALL=(root)ALL) NOPASSWD: /usr/sbin/nft, /sbin/nft
      1. ValidateSet theits filemode beforeto relying440 onand validate it: sudo visudo -c -fcf /etc/sudoers.d/knocknoc-agentagent_nftables
      2. Confirm one of the pathtwo paths in the rule matches command -v nft exactly. A rule naming /sbin/nft does not authorize /usr/sbin/nft

      Verify From the Agent's Own Account

      Run the check as the service account rather than as yourself:

      sudo -l -U knocknoc-agent | grep nft
sudo -u knocknocknocknoc-agent sudo -n nft --version

      A password promptprompt, or a "sorry,message that a password is required" messagerequired, means the rule is not taking effect.

      effect

      Onfor OpenBSD,that Use doas

      sudo is not in the OpenBSD base system. Add the equivalent rule to /etc/doas.conf and confirm it with doas -n nft --version.account.

      Or Run the Agent as Root

      If your deployment model allows it, running the agent as root removes the escalation step entirely.

      Back to top