Action ownership and permissions

[tmroberts]

From what I can tell it looks like permissions and access to actions is based on the user group membership of the person that created the action. I created a handful of actions for some teams in a new installation of Zabbix that i am rolling out and none of the actions are visible to the end users, however they are ALL visible to me. All of the end users are Zabbix Admins and I am a Super Admin. My first question is, shouldn't the access and permissions be based on the Host Group relationship of the action and not the user group? My second question, and I have looked unsuccessfully, is there a way in the database to update some records to change the ownership (or through the GUI) of the actions? Seems like this could be an issue that a lot of people encounter.

[tmroberts]

I have spent quite a bit of time digging through the database model diagram trying to see if there was some link to users or groups that would link back to actions and there isn't. Is there any place that I can go to view/modify the ownership of trigger actions? This seems like a big oversight to me.

[kloczek]

There is no such thing like ownership of trigger actions and to be honest I don't think that is urgently needed.

[tmroberts]

I did an experiment yesterday to test this out.... In our company we have "-admin" accounts for use on things like domain controllers. So I added my -admin account as a user in Zabbix and added them to a user group (i used the networking team), then created an action that included a host group their team has access to. Then I had another member of the networking team verify that they were able to view and edit that action. I then removed my user from the networking user group. They were no longer able to see the action that I created. I would argue that this is an urgent need as it appears that visibility and access to actions seems to be relative to who created it and which user group they belong to.

[kloczek]

I did an experiment yesterday to test this out.... In our company we have "-admin" accounts for use on things like domain controllers. So I added my -admin account as a user in Zabbix and added them to a user group (i used the networking team), then created an action that included a host group their team has access to. Then I had another member of the networking team verify that they were able to view and edit that action. I then removed my user from the networking user group. They were no longer able to see the action that I created. I would argue that this is an urgent need as it appears that visibility and access to actions seems to be relative to who created it and which user group they belong to.

So that is your organization problem that people are doing changes without change control or informing/flagging that they are going apply some changes.
Or some people have permission do things which they should not have.
All those organization problems have nothing to do with zabbix because if you have admin privileges you can do whatever you like/want.
Ownership will not solve any of those your organization issues.

[tmroberts]

So that is your organization problem that people are doing changes without change control or informing/flagging that they are going apply some changes.
Or some people have permission do things which they should not have.
All those organization problems have nothing to do with zabbix because if you have admin privileges you can do whatever you like/want.
Ownership will not solve any of those your organization issues.

I'm going to have to disagree here. I am attaching some screen shots that show this very thing happening:


You can see here that there are two actions (created by the team's manager). I am logged in as the Zabbix Super-Admin so that I can see all of the actions but am filtering on this specific team's actions.


Here is a user (a different account then the one used in the previous screen shot) that has been granted Zabbix Admin privileges and is part of the Infrastructure Services user group.


When logged in as the user in the previous screen shot, I am not able to see any of the actions from the first screen shot.


While I agree that there are some people that have permissions they should not have, in this case, it appears that actions and their visibility/access to them is related somehow to the user that created them and/or the user group they are/were in when the action was created. This is a big issue. I spoke with another member of this very team and he is not able to see any of these actions either. So maybe ownership isn't the right work, but there is something preventing users from seeing any actions other than the ones they created themselves.

[kloczek]

I'm going to have to disagree here. I am attaching some screen shots that show this very thing happening:

Really sorry but discussion is not about agreement or convincing someone but facts (both sides of the discussion should be using only facts and contracts).
You may ignore facts asking to agree with your opinion but usually it will make only situation worse (only because you did not reached p[roper understanding of the subject).
I have nothing to do with what you are thinking. You don't need to convince me .. really.

Fact is that if you have super user permission in zabbix or root on shell access such person can do whatever want. and only training, you knowledge and internal organisation of the team prevents (in worse case scenario) destroying things reachable for the person with such permission.
You need to discuss this with you team mates how to organize work on changes in the team of people with equal privileges. Generally it is subject of the communication and coordination in such group of the people.
Zabbix as a tool is nothing more than just tool like a knife .. you can use it to curve something beautiful or useful or slice the bread or even to kill someone ..
What exactly you will do depends only on who you are and what you know. Knife as the tool cannot stop you doing mistakes or bad things.
Exactly the same is with zabbix.
Exactly this is why zabbix has internal auditing infrastructure to record who, when and what did.
First step in case your team should be stop using admin account and create multiple zabbix super user account to have full visibility of who is doing/changing what in audit log.

[tmroberts]

I think I finally stumbled on the answer.... As a rule, we are setting up "Media" users when sending to an email alias. For example if a team wishes to have alerts sent to an email alias rather than individuals, we are creating a user with that email as the media. As a matter of practice I had been putting those users in their own user group and no other groups. When an action is configured using only those users and not individual users or user groups in the operations of the actions, users from the respective user group are not able to see the actions. By simply adding the "Media" user to the the team user group, those actions configured with it are then visible to the whole group. Still seems a bit odd to me that not ALL actions are visible to everyone though. So I wonder is there a way to assign media types to user groups? Seems like a good idea based on these findings.

[kloczek]

Not media but you can apply action of sending message to the group.
Configuration -> Actions -> Create action -> Operations tab -> Operation click on "New" -> "Send to User groups" click on "New"