I have a slightly odd scenario I could use some brainstorming help with. As my configuration sits right now, I have a server, a passive proxy, and a number of agents sitting around. Some of the agents will get activated using an item that will collect data and send back multiple items using zabbix sender (e.g. spawn a subscript that hits a healthcheck/stats page, scrape the data, and send back key/value pairs using the sender so we don't pummel a stats page that has 200+ key value pairs every 60 seconds with 200+ requests). This however is a security concern, as if a server becomes compromised, it is *possible* to install a zabbix server binary and hijack the proxy... I'll certainly be able to figure out that this has occurred when I get a queue backlog alert... but I'd really like to prevent this in the first place while still being able to use a passive proxy and be able to send using zabbix_sender to that proxy.
-
-
In case someone ends up stumbling across this some months/years from now with the same problem, I ended just putting in an iptables firewall rule towards the top:
-A INPUT -p tcp -m string --string "proxy config" ! -s ${SERVER_ADDRESS} --dport 10051 --algo bm --to 150 -j REJECT --reject-with icmp-host-prohibited
Comment