12 限制agent检查

概述

可以通过创建监控项黑名单、白名单或白名单/黑名单的组合来限制agent的检查。

为此，请结合使用两个agent 配置 参数:

• AllowKey=<pattern> - 允许哪些检查； <pattern> 使用通配符 (*)表达式指定
• DenyKey=<pattern> - 拒绝哪些检查； <pattern> 使用通配符 (*) 表达式指定

请注意:

• 缺省情况下，所有 system.run[*] 监控项 (远程命令，脚本) 是禁用的，即便没有指定拒绝健；
• 从 Zabbix 5.0.2 开始，agent参数 EnableRemoteCommands :
  • Zabbix agent 已弃用
  • Zabbix agent2 不支持

因此，要允许所有远程命令，请指定AllowKey=system.run[<command>,*] ，其中* 代表等待模式和非等待模式。还可以指定AllowKey=system.run[*]参数来允许所有命令的等待和非等待模式。要禁止特定的远程命令，在AllowKey=system.run[*] 参数之前添加DenyKey参数，并使用system.run[]来指定命令。

重要规则

• 没有拒绝规则的白名单只允许 system.run[*]监控项。对于所有其它监控项，如果没有DenyKey参数，则不允许使用AllowKey 参数； 这种只有AllowKey参数情况下， Zabbix agent 将不会启动。
• 顺序很重要。指定参数在配置文件中按其出现顺序逐一检查:
  • 一旦监控项键值与允许/拒绝规则匹配，该项即被允许或拒绝；并且规则检查停止。因此，如果一个项同时满足允许规则和拒绝规则，那么结果取决于最先匹配到的那个规则。
  • 顺序还影响EnableRemoteCommands参数（如果使用的话）。
• 支持无限数量的AllowKey/DenyKey参数。
• • AllowKey、DenyKey规则不影响HostnameItem、HostMetadataItem、HostInterfaceItem配置参数。
• • 键模式是一个通配符表达式，其中通配符 (*)与特定位置的任意数量的任意字符匹配。它可以用于关键字名称和参数。
• 如果在agent配置中不允许某个特定的监控项，则该监控项将被报告为不受支持（没有给出有关原因的提示）;
• Zabbix agent命令行使用带--print（-p）选项将不显示配置为不允许的键值;
• Zabbix agent命令行使用有--test（-t）选项将会显示配置不允许的键值为"Unsupported item key"状态;
• 拒绝的远程命令不会记录在agent日志中（如果LogRemoteCommands=1）。

Allow/deny rule order

You can specify an unlimited number of AllowKey or DenyKey rules, though their order matters.

• Rules are evaluated one by one, from top to bottom.
• When an item key matches a rule, it is either allowed or denied, and rule evaluation stops.

For example, when evaluating vfs.file.contents[/etc/passwd], the rules are processed as follows:

AllowKey=vfs.file.contents[/tmp/app.log]    # Item key pattern does not match, agent proceeds to the next rule.
       AllowKey=vfs.file.contents[/etc/passwd]     # Item key pattern matches; agent allows the item check and stops rule evaluation.
       DenyKey=vfs.file.*[*]                       # Agent ignores the rule, as the evaluation has stopped.

The following rule order will deny the item check:

DenyKey=vfs.file.*[*]                       # Item key pattern matches; agent denies the item check and stops rule evaluation.
       AllowKey=vfs.file.contents[/etc/passwd]     # Agent ignores the rule, as the evaluation has stopped.
       AllowKey=vfs.file.contents[/tmp/app.log]    # Agent ignores the rule, as the evaluation has stopped.

用例

Allowing specific checks and commands

Allow only two vfs.file item checks and two system.run commands:

AllowKey=vfs.file.contents[/tmp/app.log]
       AllowKey=vfs.file.size[/tmp/app.log]
       AllowKey=system.run[/usr/bin/uptime]
       AllowKey=system.run[/usr/bin/df -h /]
       DenyKey=vfs.file.*[*]

Allowing scripts

Allow Zabbix agent to execute scripts on hosts via all available methods:

• Global scripts that can be executed in the frontend or via API (this method always uses the system.run[myscript.sh] key)
• Remote commands from action operations (this method always uses the system.run[myscript.sh,nowait] key)
• system.run Zabbix agent items with the script, for example:
  • system.run[myscript.sh]
  • system.run[myscript.sh,wait]
  • system.run[myscript.sh,nowait]

AllowKey=system.run[myscript.sh,*]

To control the wait/nowait parameter, you must set a different rule. For example, you can allow only system.run[myscript.sh,wait] items, thus excluding other methods:

AllowKey=system.run[myscript.sh,wait]

Securing allow/deny rules

This example shows how to secure overly permissive AllowKey or DenyKey rules.

Consider the following rules:

AllowKey=system.run["C:\Program^ Files\Zabbix^ Agent^ 2\scripts\test.bat*"]
       DenyKey=vfs.file.*
       DenyKey=system.cpu.load[*]

These rules contain a wildcard (*), which can be misused:

• The test.bat script can be executed with any arguments, including unintended ones.
• The vfs.file.* pattern matches only item keys without parameters; however, all vfs.file items require parameters.
• The system.cpu.load[*] pattern matches only item keys with parameters; however system.cpu.load items do not require parameters.

To secure these rules, explicitly allow executing test.bat only with specific arguments, and deny correct item key patterns; for example:

AllowKey=system.run["C:\Program^ Files\Zabbix^ Agent^ 2\scripts\test.bat status"]
       AllowKey=system.run["C:\Program^ Files\Zabbix^ Agent^ 2\scripts\test.bat version"]
       DenyKey=vfs.file.*[*]
       DenyKey=system.cpu.load
       DenyKey=system.cpu.load[*]

You can test the rules by running the following commands, which will return ZBX_NOTSUPPORTED.

cd "C:\Program Files\Zabbix Agent 2"
       zabbix_agent2.exe -t system.run["C:\Program^ Files\Zabbix^ Agent^ 2\scripts\test.bat debug"]
       zabbix_agent2.exe -t vfs.file.size["C:\ProgramData\MyApp\config.ini"]
       zabbix_agent2.exe -t vfs.file.contents["C:\Windows\System32\drivers\etc\hosts"]
       zabbix_agent2.exe -t system.cpu.load
       zabbix_agent2.exe -t system.cpu.load[all,avg1]

模式示例