Permission denied for ping from the console

[kokomo]

On the console I go to Monitoring -> Maps -> click on an active computer and select Ping.

Then a new window opens and says Error Description: Permission denied
Ping: /bin/ping -c 3 x.x.x.x

FPING is working fine on this server.
What could cause this problem?

[richlv]

in this case you need basic ping, not fping - and it should be accessible by zabbix user. why that's not the case, hard to say. maybe selinux, maybe grsecurity, maybe something else.

[kokomo]

Ping

I use Fedora 12. When I do ping as Zabbix user from SSH there is no problem.

This happens "On the console I go to Monitoring -> Maps -> click on an active computer and select Ping."

[kokomo]

Anyone experienced the same error? I really have no idea why this happens. There is nothing recorded in the zabbix_agent.log.

[bberger]

Have the same exact problem. The selected ping used to work fine but now I get the error:

Script Error

With further explaination:

Error Description: Permission denied

For the command:

Ping: /bin/ping -c 3 XXX.XXX.XXX.XXX

If I login to the server and su to zabbix, /bin/ping works fine. Permissions on /bin/ping are:

rwxr-xr-x

and all execute permissions are on /bin.

[richlv]

is selinux, apparmor, grsecurity or similar running/enabled on the machine ?

[MrKen]

What about your user's permissions for that device?

See Administration --> Scripts. Check the User Group, Host Group and Host Access.

[bberger]

is selinux, apparmor, grsecurity or similar running/enabled on the machine ?

This is definitely an selinux issue. I disabled selinux temporarily and the ping worked again. I need to have selinux enforcing on this server. I've been looking through tons of howtos on selinux and I can't figure out how to enable ping for zabbix with selinux. Has anyone successfully done this that can offer some help?

[NOB]

Hi bberger

if you are using the "ping" via the frontend menu in Zabbix, the user running
this script is, in fact, the user of the webserver (nobody ?) and not
the user zabbix.

The user, e.g. "nobody", is probably restricted for using some/all commands.

A similar problem happened on older versions of zabbix with selinux
enabled: The frontend did always report "zabbix_server running: No"
because the user running the webserver was not allowed to do a "ps" for
all processes not running under the same user as the webserver. So the list
of processes named "zabbix_server" was empty.

HTH,

Norbert.

[richlv]

if you are using the "ping" via the frontend menu in Zabbix, the user running
this script is, in fact, the user of the webserver (nobody ?) and not
the user zabbix.

hmm. are we talking about the same script functionality ?
the ones that can be managed in "administration -> scripts" and are available in netowrk maps, dashboard and some other locations are, in fact, run by zabbix_server process, and thus executed under zabbix user as well