Secure mobile access
This page contains best practices for keeping Zabbix mobile app and Zabbix bridge adapter secure.
Protect mobile devices
To prevent other people from opening the app on your mobile device, enable app lock in the app Settings.
If a device has been lost or compromised, remove it in the Zabbix web interface. This revokes and removes its access credentials, so the device can no longer access Zabbix. Depending on your user role permissions, you can remove devices in the following sections:
- User settings > Devices - any user can remove their own devices (requires the Manage own devices permission).
- Users > Devices - Super admin can remove any user's devices (requires the Manage user devices permission).
You can also limit which parts of Zabbix can be accessed from a mobile device. To do this, assign users a user role that grants only the permissions the app requires. The minimal permissions are as follows:
| Section | Configuration |
|---|---|
| Access to UI elements | Clear all checkboxes. |
| Access to services | Set Read-write access to services and Read-only access to services to None. |
| Access to modules | Clear all checkboxes. |
| Access to API | Clear the Enabled checkbox. |
| Access to actions | Clear all checkboxes. To let users update problems in the app, also mark the actions they need: - Add problem comments - Change severity - Acknowledge problems - Suppress problems - Close problems - Create and edit own media Note that the problems that users can see in the app also depend on their access to hosts. |
| Devices | Mark the Enabled checkbox. To let users add and remove their own mobile devices, also mark the Manage own devices checkbox; otherwise, a Super admin must manage their devices in Users > Devices. |
Protect Zabbix bridge adapter
Zabbix bridge adapter stores its data (state file and encryption keys) in the directory specified in the DataDir parameter of Zabbix bridge adapter configuration file.
Make sure that the directory has 0700 permissions, and all files stored in it have 0600 permissions.
Zabbix bridge adapter passes requests from mobile devices to Zabbix API.
To restrict which API methods can be called through Zabbix bridge adapter, use its AllowedAPIMethods parameter.
For example, allow only the minimal set of methods that the mobile app requires, or even fewer, if you do not want some mobile app features to be used (e.g., do not allow event.acknowledge if mobile app users should not update problems).