fping from zabbix agent - permission denied
2
votes
1
answer
3215
views
I know there are several topics about fping and zabbix, but I've read through them all and I am still having trouble getting something that should be pretty simple working.
I am trying to do a simple ping test from a host (that's running zabbix agent) to an external host.
In my zabbix_agentd.conf file I have setup a UserParameter such as:
UserParameter=vpnPing[*],fping $1 |grep -c alive
My fping permissions are as such:
# ls -l /sbin/fping
-rwsr-sr-x. 1 root zabbix 52904 Aug 5 2019 /sbin/fping
If I run the zabbix_agentd test I get (fake ip listed for example purposes)
# zabbix_agentd -t vpnPing[123.456.78.901]
vpnPing[123.456.78.901] [t|1]
So that seems to work.
When I go to the zabbix UI and look at the latest data I see:
2020-06-04 17:55:30 sh: /usr/sbin/fping: Permission denied
0
The interesting this is the 0 at the bottom. I've also seen it be 1 at times. That sounds like something is working, but I don't get why I get the permission denied.
Also when I look at the audit log I see:
type=AVC msg=audit(1591330891.927:15933): avc: denied { execute } for pid=52320 comm="sh" name="fping" dev="nvme0n1p2" ino=8410299 scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=system_u:object_r:ping_exec_t:s0 tclass=file permissive=0
type=SYSCALL msg=audit(1591330891.927:15933): arch=c000003e syscall=21 success=no exit=-13 a0=5601874ee450 a1=1 a2=7ffe62a48db0 a3=0 items=0 ppid=52319 pid=52320 auid=4294967295 uid=990 gid=988 euid=990 suid=990 fsuid=990 egid=988 sgid=988 fsgid=988 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:zabbix_agent_t:s0 key=(null)ARCH=x86_64 SYSCALL=access AUID="unset" UID="zabbix" GID="zabbix" EUID="zabbix" SUID="zabbix" FSUID="zabbix" EGID="zabbix" SGID="zabbix" FSGID="zabbix"
type=PROCTITLE msg=audit(1591330891.927:15933): proctitle=7368002D63006670696E67203136372E3134342E38392E323238207C67726570202D6320616C697665
I'm running RHEL 8.2.
# zabbix_agentd -V
zabbix_agentd (daemon) (Zabbix) 4.4.9
$ zabbix_server -V
zabbix_server (Zabbix) 4.4.9
# fping -v
fping: Version 3.16
I have the Item in Zabbix configured as Type: Zabbix agent
If I try:
zabbix_get -s [my_zabbix_server_ip] -k vpnPing[123.456.78.901]
it does timeout (not sure why as I can ping it just fine normally): zabbix_get : Timeout while executing operation
But not sure that last part with zabbix_get is relevant b/c the checks to seem to be getting back to the zabbix server but it just says permission denied.
I've been struggling with this for a while now and hoping someone can help me out?
Asked by Vishal Shah
(21 rep)
Jun 5, 2020, 12:54 AM
Last activity: Apr 11, 2025, 06:06 AM
Last activity: Apr 11, 2025, 06:06 AM