Suggestion : Access Control on Proxies

[dan_cytexone]

We would like to utilize Zabbix in a multi-tenant environment. The challenge we are having is users that have write access to host files have the ability to select proxies that do not belong to them.

Is there a way to restrict proxies to certain user groups, with a patch or modification? Or is this something that can be added in future releases?

Thanks in advance for your help.

Dan

[Rinus Tinus]

+1

+1 over here, hitting same issue (zabbix server 2.4/3.0).

[kloczek]

Hosts autodiscovery and autoregistrations actions solves problem of assigning proxies to hosts and nothing needs to be done here manually.

[Rinus Tinus]

Hi Kloczek,


Thnx for your input.

The setup in our case: we have multiple sites with their own engineers who may only monitor/add their own local hosts. The easiest way to go is to give those engineers only permission to use their own local proxy server. Thus they are not able to manage other sites.

We have used the lld/discovery construction in the past however we ran into the problem that we discover multiple objects that desire different templates and there is no parameter or anything to figure out which template they desire (manual intervention is required). There is no way for us to gain this information by a discovery script its real "end user input". Since with lld you are bound to the templates you define in the discovery task you can not alter that manually (we could fool the zabbix-server by doing some sql queries and change the template of the discovered item).

But gives me the question, with auto registration it is possible to add the host to another template however I believe you can not use custom lld scripts to create autoregistration objects (I believe it only works for agents and snmp devices right)?. In our case we pull this data from graphite and push it trough json towards zabbix (since graphite is good for metrics its not so usefull for alerts). With discovery you are stuck to the templates bound in the discovery task. Obviously you can disable triggers/items manually but that is in our case a lot of work since we have over 200 items per host. And about 50 of those hosts on different sites. I've also tried it with zabbix-sender but that only works if the hosts/items are already in place.

Then again you gave me an Idea that might work for us. We could alter the discovery scripts at the proxy side to include and exclude the desired hosts to be only detected by the correct lld task, resulting in getting the template you "define" at the proxy side where the lld is executed. In these lld scripts we already send an object named "siteid" which will bind the host to the correct host-group.

Thnx

[kloczek]

Hosts autodiscovery and autoregistration is not about duplicated items and LLDs

On using autoregiestration you must use active agents setup (ServerActive=<your.proxy.hostname.or.IP> and StartAgents=0)
Agent on first start is asking proxy for monitoring cfg data.
If host is not registered in zabbix proxy is not able to send to agent such data. However information about this empty request is send back to zabbix server and on server basing on current definition of autoregistration actions (Administration -> Actions -> Auto registration) is possible to register new host basing on informations like:

• from behind which one proxy request about cfg data come
• pattern in hostname
• other criteria

is possible to automatically register such host -> place it in group(s) -> add monitoring of such host using exact proxy -> start use on host exact set of templates.
When host is registered monitoring data about what needs to be monitored to will be placed in zabbix server config cache and on next connection between proxy and server new updated batch of cfg data of all host monitored will be send to proxy. At the end agent asking next time proxy about monitoring data will receive cfg data about what needs to be monitored on host.

Autoregistration proxy can trigger as well disable monitoring of the host when exact criteria are fulfilled (look into Criteria and Operations tabs in Action definition).