Privacy Concerns

[zabbixzabbix]

We are just starting to use Zabbix for our monitoring both internal and for customers. One of our customers requires the ability to disable monitoring as they are working on one of their servers. Apparently this requires the user to be a "Zabbix Admin" seeing as the Zabbix User can't disable alerts.

My problem is that if I give the user Zabbix Admin privileges, he can create/edit/view the Actions. If the customer digs into this he can see the list of all the users and all the user groups on the zabbix server. You can repeat this by logging in as a Zabbix Admin and creating an Action. Create a new Action operation, then in the Send message to (single user or user group) press select. You can see every user and every single usergroup on the server. Our customer is very concerned about privacy, and they are the type who will dig in and notice this. They will come back to us saying "If we can see other peoples info, then other people can see ours".


1. Is there a way to have the "Zabbix User" be able to put devices in maintenance mode?

2. If not, how can I prevent Zabbix Admins from being able to access the list of every single user or group on the box.

I've tried searching for this problem, but wasn't able to find anything. If there is another post with this information please let me know.

[Tenzer]

All this you are mentioning is made in the frontend code, so if you have knowledge of PHP programming, you can make the required changes in the source code yourself.

[NOB]

We are just starting to use Zabbix for our monitoring both internal and for customers. One of our customers requires the ability to disable monitoring as they are working on one of their servers. Apparently this requires the user to be a "Zabbix Admin" seeing as the Zabbix User can't disable alerts.

My problem is that if I give the user Zabbix Admin privileges, he can create/edit/view the Actions. If the customer digs into this he can see the list of all the users and all the user groups on the zabbix server. You can repeat this by logging in as a Zabbix Admin and creating an Action. Create a new Action operation, then in the Send message to (single user or user group) press select. You can see every user and every single usergroup on the server. Our customer is very concerned about privacy, and they are the type who will dig in and notice this. They will come back to us saying "If we can see other peoples info, then other people can see ours".


1. Is there a way to have the "Zabbix User" be able to put devices in maintenance mode?

2. If not, how can I prevent Zabbix Admins from being able to access the list of every single user or group on the box.

I've tried searching for this problem, but wasn't able to find anything. If there is another post with this information please let me know.

Two solutions come to mind.

Either

1. Create an item, say "Maintenance". This checks for existence of a file, say /tmp/Maintenance or C:\Maintenance.txt
2. Base all triggers on this item, i.e. on non-existence of this file
3. The maintenance people just create this file when they start work and delete it at the end.
4. Perhaps it is a good idea to create a trigger which warns if the file exists for more than a certain number of hours to avoid forgot to remove the file problems

or

Wait for ZABBIX version 1.8 scheduled for the end of october 2009, i.e. a few weeks.
Setting maintenance windows for a host can be done way in advance.

HTH,

Norbert.

[nelsonab]

Wait for ZABBIX version 1.8 scheduled for the end of october 2009, i.e. a few weeks.

There will be another means, hope to have more soon.