mbox series

[v4,0/6] zabbix_agentd: Update to v5.0.21 (LTS)

Message ID 20220303210254.3116-1-robin.roevens@disroot.org
Headers
Series zabbix_agentd: Update to v5.0.21 (LTS) |

Message

Robin Roevens March 3, 2022, 9:02 p.m. UTC 
  Hi All

Another new version of this patchset, hopefulle removing all 
Michael's concerns about the earlier configfile handling.

In the meantime yet another version of Zabbix was released, so the first
patch is again a plain software update, now to v5.0.21.

Second patch fixes a few small bugs from current pak like not backing up
the modules dir that can contain user supplied binary modules. 
Nothing changed here.

Third patch reorganizes how the Zabbix agent config files are installed
on IPFire to ease future IPFire customizations seperately from user added
configurations.
- The main config file is now a custom one from IPFire, only containing
  the bare minimal config required. 
- Introduced a "mandatory" IPFire specific Zabbix configfile with
  settings required for correct integration of the agent in IPFire
  that should never be modified by the user.
  (pidfile, logfile, logrotation, location of user-managed directories)
- Moved IPFire provided custom "userparameters" to /var/ipfire/... to 
  make /etc/zabbix_agentd/zabbix_agentd.d completely user-managed.
- Up to date vendor supplied configfile (with lots of documentation in it)
  is now deployed and overwritten on every install/update as 
  'zabbix_agentd.conf.example' as reference for the user.
During an update, the current zabbix main config will remain as is, but
"Include" lines will be added at the end to include the new IPFire 
configfiles. Also settings now moved to the IPFire managed "mandatory"
config file are stripped from the current "user"-config.

The fourth patch reorganizes how the sudoers files are installed.
Previously there was one file 'zabbix' with sudo-rights required for the
IPFire specific "userparameter" (pakfire status). And the user was 
encouraged both in the file and on the wiki to use that file if he wants
to add commands himself for the agent to run as root.
This prevents us, or at least makes it more dificult for us to add or 
modify command in the future without touching the user added commands.
Now there are 2 sudoers files installed: 
- 'zabbix_agentd' - managed by IPFire with comment for user not to 
                    touch that file. And
- 'zabbix_agent_user' - initially empty apart from comments, for users
                        to add their own custom commands.
As there where only ever 2 versions of the original sudoers file 'zabbix',
during update it is checked if an existing 'zabbix' 
(or even older 'zabbix.user' file) is still original and untouched by the
user (using md5). If so, it is plain removed as functionality is now in
the new 'zabbix_agentd' sudoers file. If the file was ever modified by 
the user it is renamed to 'zabbix_agentd_user' so that user added
commands will remain working.

The fifth patch configured new zabbix_agentd installs to only listen on 
the GREEN interface. Don't see an immediate reason to let the agent 
listen on all interfaces as it does by default. Changes are the largest
the the user will have his Zabbix server running somewhere in the GREEN
network. And if not, this will at least let the user think about where
to let the agent listen.

The sixth patch adds additional IPFire specific metrics to the agent
for the Zabbix Server to retrieve. Those will be documented on the wiki
after this patch is accepted.

Regards

Robin