Provide safe way to execute certain tasks which had been automated prior to 7.0 as a root user

Vinit,

The following suggestion was made by engineering as a workaround. Will this work for you:

echo supportuser | sudo -S bash -c '<original command here>'

Certificate Update Process and Access Control Requirements

Current Documentation Reference

The IBM SevOne NPM certificate generation guide requires executing the following commands on root-owned files:

mv /secrets/nginx/nginx.crt /secrets/nginx/nginx.crt.old
mv /secrets/nginx/nginx.key /secrets/nginx/nginx.key.old
mv nginx.crt /secrets/nginx/nginx.crt
mv nginx.key /secrets/nginx/nginx.key
chmod 400 /secrets/nginx/nginx.crt /secrets/nginx/nginx.key

Access Control Challenge

Current State:

• The support user has sudo privileges but requires password authentication
• Root access has been intentionally removed for security purposes

Problem: Automated certificate update scripts cannot execute these commands without either:

1. Root access (security risk - removed by design)
2. Passwordless sudo for the support user (security risk - negates the purpose of removing root access)

Proposed Solution: Implement a restricted privilege escalation mechanism that allows the support user (or a dedicated service account) to execute only the specific commands required for certificate management, without granting broad sudo access.

This approach maintains security by:

• Limiting elevated permissions to predefined, audited commands
• Preventing unauthorized privilege escalation
• Enabling automation without compromising the security posture

Vinit, can you be more specific about which certs you used automation to update on the NMS hosts prior to 7.X that you're having difficulty with now?