+++ /dev/null
-From da7f1292838f087e2179705f2778f78ddd85cba8 Mon Sep 17 00:00:00 2001
-From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
-Date: Wed, 17 Dec 2025 18:28:37 -0500
-Subject: [PATCH] zabbix_agentd: Tweak config file for OpenWrt
-
-Note: original patch had no header, header added 2025-12-16, while
-bumping package version. Modified 2025-12-25. Modified 2026-01-21.
-
-1. Use syslog not a file for logging
-2. Place PidFile under /var/run/zabbix
-3. Only start passive agent by default
-4. Do not do active checks by default
-5. Use the system hostname as hostname (except on zabbix server)
-6. Include configurations under /etc/zabbix_agentd.conf.d/
-7. Drop privileges to the zabbix-agent user (instead of zabbix)
-
-Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
----
- conf/zabbix_agentd.conf | 19 +++++++------------
- 1 file changed, 7 insertions(+), 12 deletions(-)
-
---- a/conf/zabbix_agentd.conf
-+++ b/conf/zabbix_agentd.conf
-@@ -3,12 +3,11 @@
-
- ############ GENERAL PARAMETERS #################
-
--### Option: PidFile
--# Name of PID file.
--#
--# Mandatory: no
--# Default:
--# PidFile=/tmp/zabbix_agentd.pid
-+# Zabbix always creates a PidFile. Make sure it is where we want it.
-+PidFile=/var/run/zabbix-agent/zabbix_agentd.pid
-+
-+# use syslog
-+LogType=system
-
- ### Option: LogType
- # Specifies where log messages are written to:
-@@ -27,8 +26,6 @@
- # Default:
- # LogFile=
-
--LogFile=/tmp/zabbix_agentd.log
--
- ### Option: LogFileSize
- # Maximum size of log file in MB.
- # 0 - disable automatic log rotation.
-@@ -136,6 +133,7 @@ Server=127.0.0.1
- # Range: 0-100
- # Default:
- # StartAgents=10
-+StartAgents=1
-
- ##### Active checks related
-
-@@ -166,8 +164,6 @@ Server=127.0.0.1
- # Default:
- # ServerActive=
-
--ServerActive=127.0.0.1
--
- ### Option: Hostname
- # List of comma delimited unique, case sensitive hostnames.
- # Required for active checks and must match hostnames as configured on the server.
-@@ -177,8 +173,6 @@ ServerActive=127.0.0.1
- # Default:
- # Hostname=
-
--Hostname=Zabbix server
--
- ### Option: HostnameItem
- # Item used for generating Hostname if it is undefined. Ignored if Hostname is defined.
- # Does not support UserParameters or aliases.
-@@ -317,7 +311,7 @@ Hostname=Zabbix server
- #
- # Mandatory: no
- # Default:
--# User=zabbix
-+User=zabbix-agent
-
- ####### USER-DEFINED MONITORED PARAMETERS #######
-
-@@ -547,5 +541,6 @@ Hostname=Zabbix server
- # Include=
-
- # Include=/usr/local/etc/zabbix_agentd.userparams.conf
--# Include=/usr/local/etc/zabbix_agentd.conf.d/
- # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf
-+Include=/usr/share/zabbix_agentd.openwrt-params.d/
-+Include=/etc/zabbix_agentd.conf.d/
--- /dev/null
+From 502248599bfc0b36daf0f8dd83bee5bc6e1b24e4 Mon Sep 17 00:00:00 2001
+From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
+Date: Wed, 17 Dec 2025 18:28:37 -0500
+Subject: zabbix_agentd: tweak config file for OpenWrt
+
+Note: original patch had no header, header added 2025-12-16, while
+bumping package version. Modified 2025-12-25. Modified 2026-01-21.
+Tweaked further 2026-07-16.
+
+1. Use syslog not a file for logging.
+2. Place PidFile under /var/run/zabbix-agent.
+3. Only start 1 passive agent by default.
+4. Do not do active checks by default.
+5. Use the system hostname as hostname.
+6. If started as root, drop privileges to the zabbix-agent user, not
+ a shared (with server and proxy) zabbix user or root, per upstream
+ recommendation:
+ https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation
+7. Include configuration files under /etc/zabbix_agentd.conf.d/.
+8. Require configurations under /etc/zabbix_agentd.conf.d/ end in .conf.
+ (other files are ignored for configuration purposes).
+
+Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
+---
+ conf/zabbix_agentd.conf | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/conf/zabbix_agentd.conf
++++ b/conf/zabbix_agentd.conf
+@@ -10,6 +10,9 @@
+ # Default:
+ # PidFile=/tmp/zabbix_agentd.pid
+
++# Zabbix always creates a PidFile. Make sure it is where we want it.
++PidFile=/var/run/zabbix-agent/zabbix_agentd.pid
++
+ ### Option: LogType
+ # Specifies where log messages are written to:
+ # system - syslog
+@@ -20,6 +23,9 @@
+ # Default:
+ # LogType=file
+
++# Use syslog
++LogType=system
++
+ ### Option: LogFile
+ # Log file name for LogType 'file' parameter.
+ #
+@@ -27,7 +33,7 @@
+ # Default:
+ # LogFile=
+
+-LogFile=/tmp/zabbix_agentd.log
++# LogFile=/tmp/zabbix_agentd.log
+
+ ### Option: LogFileSize
+ # Maximum size of log file in MB.
+@@ -136,6 +142,7 @@ Server=127.0.0.1
+ # Range: 0-100
+ # Default:
+ # StartAgents=10
++StartAgents=1
+
+ ##### Active checks related
+
+@@ -166,7 +173,7 @@ Server=127.0.0.1
+ # Default:
+ # ServerActive=
+
+-ServerActive=127.0.0.1
++# ServerActive=127.0.0.1
+
+ ### Option: Hostname
+ # List of comma delimited unique, case sensitive hostnames.
+@@ -177,7 +184,7 @@ ServerActive=127.0.0.1
+ # Default:
+ # Hostname=
+
+-Hostname=Zabbix server
++# Hostname=Zabbix server
+
+ ### Option: HostnameItem
+ # Item used for generating Hostname if it is undefined. Ignored if Hostname is defined.
+@@ -318,6 +325,7 @@ Hostname=Zabbix server
+ # Mandatory: no
+ # Default:
+ # User=zabbix
++User=zabbix-agent
+
+ ####### USER-DEFINED MONITORED PARAMETERS #######
+
+@@ -549,3 +557,5 @@ Hostname=Zabbix server
+ # Include=/usr/local/etc/zabbix_agentd.userparams.conf
+ # Include=/usr/local/etc/zabbix_agentd.conf.d/
+ # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf
++Include=/usr/share/zabbix_agentd.openwrt-params.d/
++Include=/etc/zabbix_agentd.conf.d/*.conf
-From ca45744e63b957d83cdbc2a28588077cbf8b5639 Mon Sep 17 00:00:00 2001
+From 6655a1f2e5bff8d0082f41cf2711339f0d75d788 Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Wed, 17 Dec 2025 06:39:16 -0500
-Subject: [PATCH] Make zabbix_server config suitable for OpenWrt
+Subject: zabbix_server: tweak config file for OpenWrt
-1. Log to (default ephemeral) syslog, not a file (and don't rotate)
+Created 2025-12-17. Updated 2026-07-16.
+
+1. Log to syslog, not a file.
2. Update PidFile path so correct permissions can be set for access by
- Zabbix server running without privileges
+ Zabbix server running without privileges.
3. If started as root, drop privileges to zabbix-server user (instead of
- zabbix)
-4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin)
-5. Configure fping as the ipv6 fping as well
-6. For privacy, disable the public API call to check Zabbix version
+ zabbix user shared with agent and proxy, or root) per upstream
+ recommendation:
+ https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation.
+4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin).
+5. Configure fping as the ipv6 fping as well.
+6. For privacy, disable the public API call to check Zabbix version.
+7. Include configurations under /etc/zabbix_server.conf.d/.
+8. Require configurations under /etc/zabbix_server.conf.d/ end in .conf
+ (other files are ignored for configuration purposes).
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
---
- conf/zabbix_server.conf | 15 +++++++++++----
- 1 file changed, 11 insertions(+), 4 deletions(-)
+ conf/zabbix_server.conf | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
--- a/conf/zabbix_server.conf
+++ b/conf/zabbix_server.conf
### Option: LogFileSize
# Maximum size of log file in MB.
-@@ -45,6 +46,7 @@ LogFile=/tmp/zabbix_server.log
- # Range: 0-1024
- # Default:
- # LogFileSize=1
-+LogFileSize=0
-
- ### Option: DebugLevel
- # Specifies debug level:
-@@ -67,6 +69,10 @@ LogFile=/tmp/zabbix_server.log
+@@ -67,6 +68,10 @@ LogFile=/tmp/zabbix_server.log
# Default:
# PidFile=/tmp/zabbix_server.pid
### Option: SocketDir
# IPC socket directory.
# Directory to store IPC sockets used by internal Zabbix services.
-@@ -610,7 +616,7 @@ Timeout=4
- #
+@@ -611,6 +616,7 @@ Timeout=4
# Mandatory: no
# Default:
--# FpingLocation=/usr/sbin/fping
+ # FpingLocation=/usr/sbin/fping
+FpingLocation=/usr/bin/fping
### Option: Fping6Location
### Option: SSHKeyLocation
# Location of public and private keys for SSH checks and actions.
-@@ -698,7 +705,7 @@ LogSlowQueries=3000
- #
+@@ -699,6 +706,7 @@ LogSlowQueries=3000
# Mandatory: no
# Default:
--# User=zabbix
+ # User=zabbix
+User=zabbix-server
### Option: SSLCertLocation
# Location of SSL client certificates.
-@@ -1050,7 +1057,7 @@ EnableGlobalScripts=0
+@@ -1050,7 +1058,7 @@ EnableGlobalScripts=0
#
# Mandatory: no
# Default:
### Option: SMSDevices
# List of comma delimited modem files allowed to use Zabbix server
+@@ -1125,3 +1133,4 @@ EnableGlobalScripts=0
+ # Include=/usr/local/etc/zabbix_server.general.conf
+ # Include=/usr/local/etc/zabbix_server.conf.d/
+ # Include=/usr/local/etc/zabbix_server.conf.d/*.conf
++Include=/etc/zabbix_server.conf.d/*.conf
git.99rst.org / openwrt-packages.git / commitdiff