Zabbix ports, auto deployment and remote control

[Tharbad]

Hi all,

I have 3 questions:
1) What ports do I need to open in my firewall? I need to know protocol, direction and port numbers.
2) Is it possible to auto deploy agents?
3) Is it possible to tunnel ssh or RDP over zabbix agent<=>server communication? Is it possible to create such connection at all through zabbix?

Details:
I'm using the latest appliance.

Thanks

[steveboyson]

1) 10050/tcp/incoming to your agents, 10051/tcp/incoming to your servers or proxies. Is pretty well covered in the docs.
2) no
3) no

[Tharbad]

What about outbound traffic?

I've opened those ports but I get the following error:

Get value from agent failed: cannot connect to [[<IP>]:10050]: [4] Interrupted system call

[steveboyson]

Of course you need a way back from your agent. This is usually a high port (> 1024) and works as usual TCP connects via firewalls work.

[Tharbad]

This port has a number? Or it's random?

Thanks

[steveboyson]

It's as random as other outgoing tcp connections use random source ports.

[Tharbad]

Great...
Is there a way to make it static?

[steveboyson]

Great...
Is there a way to make it static?

Not that I know of. May I ask why is that causing troubles for you? It is just the way TCP works ...

[Tharbad]

I like my security tight. Most of the monitoring system allow static ongoing ports. It's one of those "nice to have" features with all the security buzz in the recent years.

[steveboyson]

I personally see no problem at all in this. SMTP, ssh, http, ... - they are all working that way using dynamic outgoing ports.

The rules on the firewalls almost always work with "SYN" and "TCP_ESTABLISHED" flags so that poses no probs in my opinion.