Running Zabbix Proxy on Linux under an Active Directory account?

[Jago]

As seen here: https://www.zabbix.com/forum/zabbix-...template-issue in some scenarios it can be required to run a Zabbix Proxy in the context of an Active Directory account, in order for Kerberos auth to work towards MSSQL servers in a Windows domain. I am facing this very scenario.

Instead of resorting to ugly hacks that will work, but are obviously ugly, such as manually logging in to launch the service in the context of an AD service account, what's the best angle of approach to have the regular systemd service work on boot? By default the service launches as local root and drops priviledges to whatever user is configured in zabbix_conf.

How does one make this work with an AD account? Joining the server running the proxy to AD is not the problem, but my concern is specifically which files to edit and how to provide the AD account password for authentication as the proxy service is being launched (or restarted).

[Jago]

In doing some testing, I've succesfully managed to get a test systemd service (not zabbix) to launch on a Linux system connected to AD via SSSD and do some random things. Funnily enough that didn't actually require ANY actual authentication. User "testuser" is ONLY present in AD and has a password, but the test systemd service I wrote does launch as that particular user anyway. Either way, I guess I have another hurdle ahead of me. Once I have Zabbix running under that AD account, what ugly hack am I supposed to do for Zabbix to be able to obtain a Kerberos ticket (as that ad user) in order to be able to auth to MSSQL instances using Kerberos?

[Jago]

WOW, I can't belive just how badly off the rails I almost went with this. A massive amount of people and various forum posts told me that I absolutely must have the Zabbix Proxy joined to AD for this to work, which in turn made me think I needed to run the entire Proxy itself as an AD user (which was also "confirmed" by one of the forum posts I found).

Reality: install krb5-workstation, configure krb5.conf, obtain whatever tickets you want from your AD with your local Linux user account.

So the only ugly'ish thing I will have to do is write a user systemd service for maintaining Kerberos tickets in perpetuity.