After initial setup, "SSH service is down on zabbix.example.com"

[rnelson0]

I have installed Zabbix, specifically using the puppet module wdijkerman/zabbix. After installation, I can log in and there is only one node, the server itself. The status sometimes starts green with the 11 monitored applications from the default template. However, the SSH service always goes to Warning, and sometimes it starts that way. This is odd as I can ssh to the box remotely and from the box to itself on all its interfaces.

In Configuration -> Templates -> Template App SSH Service, there is one application/items/triggers tuple.


Applications: SSH service
Items:

• Name: SSH service is running
• Key: net.tcp.service[ssh]
• Interval: 60
• History: 7
• Trends: 365
• Type: Simple check
• Applications: SSH service
• Status: Enabled

Triggers:

• Severity: Average (orange)
• Name: SSH service is down on {HOST.NAME}
• Expression: {Template App SSH Service:net.tcp.service[ssh].max(#3)}=0
• Status: Enabled

I don't know much about zabbix yet but I believe zabbix_get will let me know how the net.tcp.service[ssh] is polling.

[rnelson0@zabbix ~]$ zabbix_get -s zabbix -k net.tcp.service[ssh]
1
[rnelson0@zabbix ~]$ netstat -an | grep 22
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 64 10.0.0.9:22 10.0.0.204:57872 ESTABLISHED
[rnelson0@zabbix ~]$ ssh zabbix
rnelson0@zabbix's password:
[rnelson0@zabbix ~]$ ssh localhost
The authenticity of host 'localhost (::1)' can't be established.
ECDSA key fingerprint is 0a:56:24:79:a4:3b:8d:df:93:24:aa:3e:da:a8:b6:8c.
Are you sure you want to continue connecting (yes/no)? yes
rnelson0@zabbix's password:
[rnelson0@zabbix ~]$ ssh 127.0.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
ECDSA key fingerprint is 0a:56:24:79:a4:3b:8d:df:93:24:aa:3e:da:a8:b6:8c.
Are you sure you want to continue connecting (yes/no)? yes
rnelson0@zabbix's password:

For comparison, the https service is running (and accessible via the browser) and gives a different return code:

[rnelson0@zabbix ~]$ zabbix_get -s zabbix -k net.tcp.service[https]
0
[rnelson0@zabbix ~]$ netstat -an | grep 443
tcp6 0 0 :::443 :::* LISTEN

I am also using SELinux.

As best I can tell, ssh itself is operational. However, the net.tcp.service[ssh] check fails. Can someone point me in the right direction to further diagnose this? Thanks!

[wdijkerman]

Hi,

Well as far as I can see, the output you gave shows that SSH is running. Like my example:

[root@vserver-157 ~]# zabbix_get -s127.0.01 -p10050 -knet.tcp.service[ssh]
1
[root@vserver-157 ~]#

When editing the SSH check in the mentioned template, you'll see an configuration item: Show value
This "show value" will translate the value to an string. In this case, when the zabbix_get returns an 1 this will be translated to UP. (Administration - General, right dropdown menu "Value mapping". )

So your example for the SSH is showing the correct value: UP.
I don't know why the https is showing 0. First thought that it might be an typo, but https works on my environment and it isn't running an ssl site.

[root@vserver-157 ~]# zabbix_get -s127.0.01 -p10050 -knet.tcp.service[http]
1
[root@vserver-157 ~]# zabbix_get -s127.0.01 -p10050 -knet.tcp.service[https]
1
[root@vserver-157 ~]#

I tested this on an server with Selinux enabled and also shows the same value as one with Selinux disabled.

[rnelson0]

I think I found it after some better crafted google searches. It works fine for me at the CLI because of the SELinux context. It's denied for Zabbix though because it runs in zabbix_t. This simple fix works:

[root@zabbix audit]# getsebool -a | grep zabbix
httpd_can_connect_zabbix --> off
zabbix_can_network --> off
[root@zabbix audit]# setsebool zabbix_can_network on


I don't know if I need httpd_can_connect_zabbix for other checks but this gets me off the ground at least! I'll report back once I tie it into a puppet manifest for the agents and give it some more testing. I'll be sure to check your module documentation to see if there's a flag for this already that I missed, of course.

[rnelson0]

The pointer was found at https://www.zabbix.com/forum/showpos...1&postcount=10. The puppet class is:

class profile::zabbix::agent{
include ::zabbix::agent

selboolean{['zabbix_can_network',]:
value => on,
persistent => true,
}

firewall {'100 zabbix-client':
dport => 10050,
proto => tcp,
action => accept,
}
}

I hope that helps others.