How run script shell from Zabbix agent without permission error

[mastraze]

Hi,

I might say i was able to use many features in zabbix excepting the script shell from zabbix agent. In

/etc/zabbix/zabbix_agentd.conf

UserParameters = test, /etc/zabbix/externalscripts/test.sh


restarting the agent and get the same error in zabbix_agentd.log

PERMISSION DENIED !!!!!!!!!!!!!! :mad

The point is that the script was created by zabbix user and I am able to run it remotely from zabbix Server with zabbix user as well !!!

Changing the permission of the script even to 777 has no effect !!!

Does any one experience this before ? I think this feature is very important for advanced settings !! thanks

[mastraze]

Script Shell Zabbix agent resolved !!!

Hey,

Let me guess !!! running script in zabbix agent using UserParameter in /etc/zabbix/zabbix_agentd,conf is a very important feature in zabbix monitoring !!!

Unfortunately, it will not work in first sight because of different Linux distribution and A LOOOOT of permissions complexity running behind!!! Basically , I have posted 2 threads about running script shell in zabbix and faced this permission denied problem! NO REACTION !!! the only thing was recommended by many Zabbix users was chmod or chown or the magic number 775 to our script file !! All of that was important but NOT ENOUGH !!! I still have the same issue !!! But let 's go to the point :

1. What Linux distribution : Nor Ubuntu neither Debian but it s CentOS 6.5 !

If we check our script shell file permissions in CentOS by default we will see :

# ls -ls magic_script.sh

-rwx r-xr-x.   1 root  root         15 2014-02-29 13:12 magic_script.sh

so as you can see we have
- : type
rwx : Owner permission
r-x : Group permission
r-x : World permission

and then : THE MAGICAL DOT ....Short Story :

The file has an access list with SELinux.
But what is SELinux ?

It s a forced security mechanism enabled by default and support access control security in the Linux kernel !!!
For more information :

http://en.wikipedia.org/wiki/Security-Enhanced_Linux

Any way , in my CentOS was enabled by default and as good for security but not that really handy in test purposes. So let s get rid of this :

What we will do ? Disabled for instance and get our script running :

How ? Simply with several ways:

 # setenforce 0 | reboot

OR

# echo 0 > /selinux/enforce | reboot

OR:

Edit /etc/seclinux/config

SELINUX=disabled

and reboot !!!

check later

# sestatus

SELinux status:                 disabled

Then restart your zabbix_agentd and we get our script running !!!

But in the other hand: Disabling SElinux Just to let zabbix run the script and give some data back to server is not a very good trick !!! I might say in debian or ubuntu SElinux might be disabled by default [checked with ubuntu precise64], I think Zabbix should think also about this issue to make life easier especially for CentOS and redhat distribution !!!

I hope this will help many people and of course
Your ideas are welcome !!!