Script via Zabbix frontend

To run any script via Zabbix frontend on a remote server:

(a) Uncomment the AllowKey=system.run[*] in Zabbix agent configuration file on Remote host.

(b) Add the rules for zabbix user in sudoers file 

      visudo

      zabbix ALL=(ALL) NOPASSWD: ALL

(c) If the script (myscript.sh) is running on /usr/local/bin, make sure the script is executable and the script is owned by the Zabbix user. 

chmod +x /path/to/myscript.sh

chown zabbix:zabbix /usr/local/bin/myscript.sh

Note: The Zabbix agent runs under a specific user account, typically zabbix. Ensure that the script file is owned by this user or has appropriate permissions for the zabbix user to access and execute it.

Significance of AllowKey and sudoersfile configuration in Zabbix_agent:

1. AllowKey=system.run[*] in Zabbix Agent Configuration

The AllowKey directive in the Zabbix agent configuration file (zabbix_agentd.conf) specifies which system.run commands are permitted to be executed via the Zabbix frontend. This directive is crucial for security reasons, as it restricts which system.run commands can be executed based on the configured patterns.

Note: setting AllowKey=system.run[*] in the Zabbix agent configuration allows all commands using the system.run key to be executed from the Zabbix frontend.

• Purpose:

  • It restricts which system.run commands can be executed through Zabbix.
  • This helps prevent unauthorized or unsafe commands from being executed.

• Example Configuration:

  AllowKey=system.run[*]
  

  This allows all system.run commands. You can specify more restrictive patterns based on your security needs.

2. sudoers File Configuration

The sudoers file controls which users can execute commands with sudo and whether they need to enter a password. Configuring this file allows specific users (like the Zabbix agent) to execute certain commands with elevated privileges.

• Purpose:

  • It permits the Zabbix agent user to execute commands with elevated privileges.
  • This is necessary for commands that require root access or other privileged actions.

• Example Rule:

  zabbix ALL=(ALL) NOPASSWD: /path/to/command
  

  This allows the Zabbix user to execute /path/to/command without a password.

Why Both Are Needed

1. Security Control:

   • AllowKey=system.run[*]: Ensures only allowed system.run commands are executed, preventing potentially harmful or unauthorized commands.
   • sudoers File: Controls which commands can be run with elevated privileges and whether a password is required, ensuring that only authorized commands are executed with sudo.

2. Command Execution Control:

• AllowKey=system.run[*]: Configures Zabbix’s policy on which system.run commands can be executed. if you don't uncomment or configure AllowKey, the Zabbix agent will block system.run commands. system.run key is used in Zabbix items to specify that a system command or script should be executed on the host.
• sudoers File: Configures Linux permissions to allow those commands to be run with sudo if necessary.