Zabbix through a SSH tunnel

[Jimini]

Howdy,
I have been searching for a while (without no result, unfortunately) on how to establish a connection between my server and my agentd by using a SSH tunnel.
The Zabbix server itself stands behind a router/firewall, so it would be easier to let this system establish all connections between the two systems.

For the SSH tunnels, I use autossh:

autossh -M 33333 -N 10050:localhost:10050 -f [email protected]

and

autossh -N -M44444 -R 10051:localhost:10051 -f [email protected]

In the agent's config, I specified 127.0.0.1 as the server's address, so all traffic should be directed to the tunnel and from there to the server. But I just don't get a connection. The log shows "Listener failed with error: zbx_tcp_listen() Fatal error: unable to serve on any address. [[127.0.0.1]:10050]."
What am I doing wrong? Help would be really appreciated.

Best regards,
Jimini

[Jimini]

I was able to solve the problem by myself:

With the following commands, I establish two tunnels between the agent and the server:
autossh -M33333 -NL 10060:127.0.0.1:10050 -f [email protected]
autossh -M22222 -NR 1051:127.0.0.1:10051 -f [email protected]

These are the relevant lines of the agentd's config:

Server=127.0.0.1
ServerPort=1051
Hostname=zabbix-agent.hoster.net
ListenPort=10050
ListenIP=127.0.0.1

In the "Hosts"-Menu of Zabbix, I specified "10060" as the port on which the server connects to the host named "zabbix-agent.hoster.net".

Best regards,
Jimini

[youtube]

I was able to solve the problem by myself:

With the following commands, I establish two tunnels between the agent and the server:
autossh -M33333 -NL 10060:127.0.0.1:10050 -f [email protected]
autossh -M22222 -NR 1051:127.0.0.1:10051 -f [email protected]

These are the relevant lines of the agentd's config:


In the "Hosts"-Menu of Zabbix, I specified "10060" as the port on which the server connects to the host named "zabbix-agent.hoster.net".

Best regards,
Jimini

Thanks you so much,can you give me your email i want ask you some question
Best regards,

[Jimini]

Thanks you so much,can you give me your email i want ask you some question
Best regards,

Of course you may contact me via PM

I have to correct the solution I posted above. Today I rcognized, that zabbix_sender could not submit any data through the tunnel. I had to edit my tunnels as following:
From
autossh -M33333 -NL 10060:127.0.0.1:10050 -f [email protected]
autossh -M22222 -NR 1051:127.0.0.1:10051 -f [email protected]
to
autossh -M33333 -NL 10060:127.0.0.1:10050 -f [email protected]
autossh -M22222 -NR 1051:10.0.0.2:10051 -f [email protected]

As you can see, the second tunnel has changed. It contains now the local IP address of the zabbix server.

Best regards,
Jimini

[bbalexe]

In case any one else comes across this, I achieved the same thing using ssh port forwarding:

ssh -fNT -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -L 127.0.0.1:10058:127.0.0.1:10050 user@host

Here are the relevant settings from /etc/zabbix/zabbix_agent2.conf

ListenIP=127.0.0.1
ListenPort=10050

And then to test:

zabbix_get -s 127.0.0.1 -p 10058 -k "system.cpu.load[all,avg1]"

Cheers

Alex