From cee63f4bffd0fa553d90fb08b8260e4ae49b54d5 Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Wed, 15 Jul 2026 21:41:38 -0400 Subject: [PATCH 1/9] zabbix: bump version to 7.0.28 Update to latest LTS. See release notes: https://www.zabbix.com/rn/rn7.0.28 Signed-off-by: Daniel F. Dickinson --- admin/zabbix/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile index 8c0cc833382f5..f5693437632a6 100644 --- a/admin/zabbix/Makefile +++ b/admin/zabbix/Makefile @@ -8,13 +8,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=zabbix -PKG_VERSION:=7.0.27 -PKG_RELEASE:=2 +PKG_VERSION:=7.0.28 +PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://cdn.zabbix.com/zabbix/sources/stable/$(basename $(PKG_VERSION))/ \ https://cdn.zabbix.com/zabbix/sources/oldstable/$(basename $(PKG_VERSION))/ -PKG_HASH:=15e4c233e65c87922824d01abad624f34128bbb4af021a75e38e89b68e13e851 +PKG_HASH:=020a2649a450a642c3d74577eb583ec175f4bd85ebe2c3d39ede399487e1da33 PKG_MAINTAINER:=Daniel F. Dickinson PKG_LICENSE:=AGPL-3.0-only From 224811d863b566a00acdbbefcae465230a2dd0bf Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Wed, 15 Jul 2026 22:30:00 -0400 Subject: [PATCH 2/9] zabbix: use separate users for server and proxy This is the upstream recommendation, and fits with our seperation of agent and server. Signed-off-by: Daniel F. Dickinson --- admin/zabbix/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile index f5693437632a6..1ccd939123371 100644 --- a/admin/zabbix/Makefile +++ b/admin/zabbix/Makefile @@ -192,7 +192,6 @@ define Package/zabbix-server-or-proxy/Default +libevent2-extra \ +libpcre2 \ +zlib - USERID:=zabbix-server=70:zabbix-server=70 endef define Package/zabbix-proxy/Default @@ -202,6 +201,7 @@ define Package/zabbix-proxy/Default @zabbix-proxy-any \ zabbix-proxy-ssl \ zabbix-proxy-openssl + USERID:=zabbix-proxy=71:zabbix-proxy=71 endef define Package/zabbix-proxy @@ -281,6 +281,7 @@ define Package/zabbix-server PROVIDES:= \ zabbix-server-ssl \ zabbix-server-openssl + USERID:=zabbix-server=70:zabbix-server=70 VARIANT:=full endef From 26812a0eb0b8d622c34ee087be60829dea380c5b Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Thu, 16 Jul 2026 19:47:53 -0400 Subject: [PATCH 3/9] zabbix: tweak patch agent and server patch configs Tweak the agentd and server patch configuration and bring agentd and server confgurations to parity. Signed-off-by: Daniel F. Dickinson --- .../patches/010-change-agentd-config.patch | 92 ------------------ ...agentd-tweak-config-file-for-openwrt.patch | 97 +++++++++++++++++++ ...erver-tweak-config-file-for-openwrt.patch} | 54 ++++++----- 3 files changed, 125 insertions(+), 118 deletions(-) delete mode 100644 admin/zabbix/patches/010-change-agentd-config.patch create mode 100644 admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch rename admin/zabbix/patches/{020-change-server-config.patch => 020-zabbix_server-tweak-config-file-for-openwrt.patch} (59%) diff --git a/admin/zabbix/patches/010-change-agentd-config.patch b/admin/zabbix/patches/010-change-agentd-config.patch deleted file mode 100644 index 7450e81e62326..0000000000000 --- a/admin/zabbix/patches/010-change-agentd-config.patch +++ /dev/null @@ -1,92 +0,0 @@ -From da7f1292838f087e2179705f2778f78ddd85cba8 Mon Sep 17 00:00:00 2001 -From: "Daniel F. Dickinson" -Date: Wed, 17 Dec 2025 18:28:37 -0500 -Subject: [PATCH] zabbix_agentd: Tweak config file for OpenWrt - -Note: original patch had no header, header added 2025-12-16, while -bumping package version. Modified 2025-12-25. Modified 2026-01-21. - -1. Use syslog not a file for logging -2. Place PidFile under /var/run/zabbix -3. Only start passive agent by default -4. Do not do active checks by default -5. Use the system hostname as hostname (except on zabbix server) -6. Include configurations under /etc/zabbix_agentd.conf.d/ -7. Drop privileges to the zabbix-agent user (instead of zabbix) - -Signed-off-by: Daniel F. Dickinson ---- - conf/zabbix_agentd.conf | 19 +++++++------------ - 1 file changed, 7 insertions(+), 12 deletions(-) - ---- a/conf/zabbix_agentd.conf -+++ b/conf/zabbix_agentd.conf -@@ -3,12 +3,11 @@ - - ############ GENERAL PARAMETERS ################# - --### Option: PidFile --# Name of PID file. --# --# Mandatory: no --# Default: --# PidFile=/tmp/zabbix_agentd.pid -+# Zabbix always creates a PidFile. Make sure it is where we want it. -+PidFile=/var/run/zabbix-agent/zabbix_agentd.pid -+ -+# use syslog -+LogType=system - - ### Option: LogType - # Specifies where log messages are written to: -@@ -27,8 +26,6 @@ - # Default: - # LogFile= - --LogFile=/tmp/zabbix_agentd.log -- - ### Option: LogFileSize - # Maximum size of log file in MB. - # 0 - disable automatic log rotation. -@@ -136,6 +133,7 @@ Server=127.0.0.1 - # Range: 0-100 - # Default: - # StartAgents=10 -+StartAgents=1 - - ##### Active checks related - -@@ -166,8 +164,6 @@ Server=127.0.0.1 - # Default: - # ServerActive= - --ServerActive=127.0.0.1 -- - ### Option: Hostname - # List of comma delimited unique, case sensitive hostnames. - # Required for active checks and must match hostnames as configured on the server. -@@ -177,8 +173,6 @@ ServerActive=127.0.0.1 - # Default: - # Hostname= - --Hostname=Zabbix server -- - ### Option: HostnameItem - # Item used for generating Hostname if it is undefined. Ignored if Hostname is defined. - # Does not support UserParameters or aliases. -@@ -317,7 +311,7 @@ Hostname=Zabbix server - # - # Mandatory: no - # Default: --# User=zabbix -+User=zabbix-agent - - ####### USER-DEFINED MONITORED PARAMETERS ####### - -@@ -547,5 +541,5 @@ Hostname=Zabbix server - # Include= - - # Include=/usr/local/etc/zabbix_agentd.userparams.conf --# Include=/usr/local/etc/zabbix_agentd.conf.d/ - # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf -+Include=/etc/zabbix_agentd.conf.d/ diff --git a/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch new file mode 100644 index 0000000000000..b95cf71803ae1 --- /dev/null +++ b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch @@ -0,0 +1,97 @@ +From 502248599bfc0b36daf0f8dd83bee5bc6e1b24e4 Mon Sep 17 00:00:00 2001 +From: "Daniel F. Dickinson" +Date: Wed, 17 Dec 2025 18:28:37 -0500 +Subject: zabbix_agentd: tweak config file for OpenWrt + +Note: original patch had no header, header added 2025-12-16, while +bumping package version. Modified 2025-12-25. Modified 2026-01-21. +Tweaked further 2026-07-16. + +1. Use syslog not a file for logging. +2. Place PidFile under /var/run/zabbix-agent. +3. Only start 1 passive agent by default. +4. Do not do active checks by default. +5. Use the system hostname as hostname. +6. If started as root, drop privileges to the zabbix-agent user, not + a shared (with server and proxy) zabbix user or root, per upstream + recommendation: + https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation +7. Include configuration files under /etc/zabbix_agentd.conf.d/. +8. Require configurations under /etc/zabbix_agent.conf.d/ end in .conf. + (other files are ignored for configuration purposes). + +Signed-off-by: Daniel F. Dickinson +--- + conf/zabbix_agentd.conf | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/conf/zabbix_agentd.conf ++++ b/conf/zabbix_agentd.conf +@@ -10,6 +10,9 @@ + # Default: + # PidFile=/tmp/zabbix_agentd.pid + ++# Zabbix always creates a PidFile. Make sure it is where we want it. ++PidFile=/var/run/zabbix-agent/zabbix_agentd.pid ++ + ### Option: LogType + # Specifies where log messages are written to: + # system - syslog +@@ -20,6 +23,9 @@ + # Default: + # LogType=file + ++# Use syslog ++LogType=system ++ + ### Option: LogFile + # Log file name for LogType 'file' parameter. + # +@@ -27,7 +33,7 @@ + # Default: + # LogFile= + +-LogFile=/tmp/zabbix_agentd.log ++# LogFile=/tmp/zabbix_agentd.log + + ### Option: LogFileSize + # Maximum size of log file in MB. +@@ -136,6 +142,7 @@ Server=127.0.0.1 + # Range: 0-100 + # Default: + # StartAgents=10 ++StartAgents=1 + + ##### Active checks related + +@@ -166,7 +173,7 @@ Server=127.0.0.1 + # Default: + # ServerActive= + +-ServerActive=127.0.0.1 ++# ServerActive=127.0.0.1 + + ### Option: Hostname + # List of comma delimited unique, case sensitive hostnames. +@@ -177,7 +184,7 @@ ServerActive=127.0.0.1 + # Default: + # Hostname= + +-Hostname=Zabbix server ++# Hostname=Zabbix server + + ### Option: HostnameItem + # Item used for generating Hostname if it is undefined. Ignored if Hostname is defined. +@@ -318,6 +325,7 @@ Hostname=Zabbix server + # Mandatory: no + # Default: + # User=zabbix ++User=zabbix-agent + + ####### USER-DEFINED MONITORED PARAMETERS ####### + +@@ -549,3 +557,4 @@ Hostname=Zabbix server + # Include=/usr/local/etc/zabbix_agentd.userparams.conf + # Include=/usr/local/etc/zabbix_agentd.conf.d/ + # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf ++Include=/etc/zabbix_agentd.conf.d/*.conf diff --git a/admin/zabbix/patches/020-change-server-config.patch b/admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch similarity index 59% rename from admin/zabbix/patches/020-change-server-config.patch rename to admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch index d9251d5c094fc..04f8b5684d932 100644 --- a/admin/zabbix/patches/020-change-server-config.patch +++ b/admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch @@ -1,21 +1,28 @@ -From ca45744e63b957d83cdbc2a28588077cbf8b5639 Mon Sep 17 00:00:00 2001 +From 6655a1f2e5bff8d0082f41cf2711339f0d75d788 Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Wed, 17 Dec 2025 06:39:16 -0500 -Subject: [PATCH] Make zabbix_server config suitable for OpenWrt +Subject: zabbix_server: tweak config file for OpenWrt -1. Log to (default ephemeral) syslog, not a file (and don't rotate) +Created 2025-12-17. Updated 2026-07-16. + +1. Log to syslog, not a file. 2. Update PidFile path so correct permissions can be set for access by - Zabbix server running without privileges + Zabbix server running without privileges. 3. If started as root, drop privileges to zabbix-server user (instead of - zabbix) -4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin) -5. Configure fping as the ipv6 fping as well -6. For privacy, disable the public API call to check Zabbix version + zabbix user shared with agent and proxy, or root) per upstream + recommendation: + https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation. +4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin). +5. Configure fping as the ipv6 fping as well. +6. For privacy, disable the public API call to check Zabbix version. +7. Include configurations under /etc/zabbix_server.conf.d/. +8. Require configurations under /etc/zabbix_server.conf.d/ end in .conf + (other files are ignored for configuration purposes). Signed-off-by: Daniel F. Dickinson --- - conf/zabbix_server.conf | 15 +++++++++++---- - 1 file changed, 11 insertions(+), 4 deletions(-) + conf/zabbix_server.conf | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) --- a/conf/zabbix_server.conf +++ b/conf/zabbix_server.conf @@ -36,15 +43,7 @@ Signed-off-by: Daniel F. Dickinson ### Option: LogFileSize # Maximum size of log file in MB. -@@ -45,6 +46,7 @@ LogFile=/tmp/zabbix_server.log - # Range: 0-1024 - # Default: - # LogFileSize=1 -+LogFileSize=0 - - ### Option: DebugLevel - # Specifies debug level: -@@ -67,6 +69,10 @@ LogFile=/tmp/zabbix_server.log +@@ -67,6 +68,10 @@ LogFile=/tmp/zabbix_server.log # Default: # PidFile=/tmp/zabbix_server.pid @@ -55,11 +54,10 @@ Signed-off-by: Daniel F. Dickinson ### Option: SocketDir # IPC socket directory. # Directory to store IPC sockets used by internal Zabbix services. -@@ -610,7 +616,7 @@ Timeout=4 - # +@@ -611,6 +616,7 @@ Timeout=4 # Mandatory: no # Default: --# FpingLocation=/usr/sbin/fping + # FpingLocation=/usr/sbin/fping +FpingLocation=/usr/bin/fping ### Option: Fping6Location @@ -72,16 +70,15 @@ Signed-off-by: Daniel F. Dickinson ### Option: SSHKeyLocation # Location of public and private keys for SSH checks and actions. -@@ -698,7 +705,7 @@ LogSlowQueries=3000 - # +@@ -699,6 +706,7 @@ LogSlowQueries=3000 # Mandatory: no # Default: --# User=zabbix + # User=zabbix +User=zabbix-server ### Option: SSLCertLocation # Location of SSL client certificates. -@@ -1050,7 +1057,7 @@ EnableGlobalScripts=0 +@@ -1050,7 +1058,7 @@ EnableGlobalScripts=0 # # Mandatory: no # Default: @@ -90,3 +87,8 @@ Signed-off-by: Daniel F. Dickinson ### Option: SMSDevices # List of comma delimited modem files allowed to use Zabbix server +@@ -1125,3 +1133,4 @@ EnableGlobalScripts=0 + # Include=/usr/local/etc/zabbix_server.general.conf + # Include=/usr/local/etc/zabbix_server.conf.d/ + # Include=/usr/local/etc/zabbix_server.conf.d/*.conf ++Include=/etc/zabbix_server.conf.d/*.conf From 2f2e421eb0ea4ebabc53c3a8bea3b4611ce1ca7f Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Thu, 16 Jul 2026 20:21:41 -0400 Subject: [PATCH 4/9] zabbix: tweak server initscript and bring agentd to parity * Genericize zabbix_server initscript. * Add shellcheck overrides where needed. * Add a 'never_root' config option (default true) that determines whether server starts as an unprivileged user or starts as root and drops to an unprivileged user (unless config is changed so it always runs as root). * Bring zabbix_agentd initscript to parity with zabbix_server for the initscript and configuration. * Tweak Makefile to reduce repetition Signed-off-by: Daniel F. Dickinson --- admin/zabbix/Makefile | 21 ++++++++----- admin/zabbix/files/zabbix_agentd.config | 4 +++ admin/zabbix/files/zabbix_agentd.defaults | 3 ++ admin/zabbix/files/zabbix_agentd.init | 36 +++++++++++++++++++---- admin/zabbix/files/zabbix_server.config | 1 + admin/zabbix/files/zabbix_server.init | 16 +++++++--- 6 files changed, 64 insertions(+), 17 deletions(-) create mode 100644 admin/zabbix/files/zabbix_agentd.config create mode 100644 admin/zabbix/files/zabbix_agentd.defaults diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile index 1ccd939123371..3718721f8c4ba 100644 --- a/admin/zabbix/Makefile +++ b/admin/zabbix/Makefile @@ -493,6 +493,13 @@ endef define Package/zabbix-agentd/conffiles /etc/zabbix_agentd.conf +/etc/config/zabbix_agentd +endef + +define Package/zabbix-agentd/postinst +#!/bin/sh +[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_zabbix_agentd) && rm -f /etc/uci-defaults/90_zabbix_agentd +exit 0 endef define Package/zabbix-agentd/install @@ -500,17 +507,17 @@ define Package/zabbix-agentd/install $(call Package/zabbix/install/sbin,$(1),agentd) $(call Package/zabbix/install/etc,$(1),agentd) $(call Package/zabbix/install/init.d,$(1),agentd) + $(INSTALL_DIR) $(1)/etc/config + $(INSTALL_CONF) ./files/zabbix_agentd.config $(1)/etc/config/zabbix_agentd + $(INSTALL_DIR) $(1)/etc/uci-defaults + $(INSTALL_BIN) ./files/zabbix_agentd.defaults $(1)/etc/uci-defaults/90_zabbix_agentd endef -define Package/zabbix-agentd-basic/conffiles -/etc/zabbix_agentd.conf -endef +Package/zabbix-agentd-basic/conffiles=$(call Package/zabbix_agentd/conffiles) +Package/zabbix-agentd-basic/postinst=$(call Package/zabbix_agentd/postinst) define Package/zabbix-agentd-basic/install - $(INSTALL_DIR) $(1)/etc/zabbix_agentd.conf.d - $(call Package/zabbix/install/sbin,$(1),agentd) - $(call Package/zabbix/install/etc,$(1),agentd) - $(call Package/zabbix/install/init.d,$(1),agentd) + $(call Package/zabbix-agentd/install,$(1)) endef define Package/zabbix-proxy/conffiles diff --git a/admin/zabbix/files/zabbix_agentd.config b/admin/zabbix/files/zabbix_agentd.config new file mode 100644 index 0000000000000..9f38a26c71f09 --- /dev/null +++ b/admin/zabbix/files/zabbix_agentd.config @@ -0,0 +1,4 @@ + +config zabbix_agentd 'general' + option enabled 0 + # option never_root 1 diff --git a/admin/zabbix/files/zabbix_agentd.defaults b/admin/zabbix/files/zabbix_agentd.defaults new file mode 100644 index 0000000000000..601eb5daa2c3d --- /dev/null +++ b/admin/zabbix/files/zabbix_agentd.defaults @@ -0,0 +1,3 @@ +#!/bin/sh + +chown zabbix-agent:zabbix-agent /etc/zabbix_agentd.conf diff --git a/admin/zabbix/files/zabbix_agentd.init b/admin/zabbix/files/zabbix_agentd.init index 04bef3730d3a6..9cdd69d07bf0b 100755 --- a/admin/zabbix/files/zabbix_agentd.init +++ b/admin/zabbix/files/zabbix_agentd.init @@ -1,26 +1,50 @@ #!/bin/sh /etc/rc.common # Copyright (C) 2008-2011 OpenWrt.org +# shellcheck shell=busybox + +# shellcheck disable=SC2034 START=60 +# shellcheck disable=SC2034 USE_PROCD=1 -PROG=/usr/sbin/zabbix_agentd -CONFIG=/etc/zabbix_agentd.conf +NAME=zabbix_agentd +PROG=/usr/sbin/${NAME} +CONFIG=/etc/${NAME}.conf +USER=zabbix-agent start_service() { + local enabled never_root + # Sometimes the agentd config was installed in /etc/zabbix/zabbix_agentd.conf [ -f /etc/zabbix/zabbix_agentd.conf ] && mv /etc/zabbix/zabbix_agentd.conf ${CONFIG} - [ -f ${CONFIG} ] || return 1 + if [ ! -f "${CONFIG}" ]; then + logger "Configuration file not found: '${CONFIG}'" + return 1 + fi + + # Get enabled config option + config_load "$NAME" + config_get_bool enabled general enabled 0 + config_get_bool never_root general never_root 1 - mkdir -p /var/run/zabbix-agent - chown zabbix-agent:zabbix-agent /var/run/zabbix-agent + # shellcheck disable=SC2154 + if [ "$enabled" -eq 0 ]; then + logger "service not enabled in /etc/config/$NAME" + return 1 + fi + + mkdir -p "/var/run/$USER" + chown $USER:$USER "/var/run/$USER" procd_open_instance procd_set_param command ${PROG} -c ${CONFIG} -f + if [ "$never_root" -eq 1 ]; then + procd_set_param user ${USER} + fi procd_set_param respawn procd_set_param stdout 1 procd_set_param stderr 1 procd_close_instance } - diff --git a/admin/zabbix/files/zabbix_server.config b/admin/zabbix/files/zabbix_server.config index 45e3f3062b0ab..c6fceba4d0a38 100644 --- a/admin/zabbix/files/zabbix_server.config +++ b/admin/zabbix/files/zabbix_server.config @@ -1,3 +1,4 @@ config zabbix_server 'general' option enabled 0 + # option never_root 1 diff --git a/admin/zabbix/files/zabbix_server.init b/admin/zabbix/files/zabbix_server.init index bcbdb41cd7d7e..45137e05c476c 100755 --- a/admin/zabbix/files/zabbix_server.init +++ b/admin/zabbix/files/zabbix_server.init @@ -1,6 +1,8 @@ #!/bin/sh /etc/rc.common # Copyright (C) 2008-2025 OpenWrt.org +# shellcheck shell=busybox + # shellcheck disable=SC2034 START=59 @@ -9,9 +11,12 @@ USE_PROCD=1 NAME=zabbix_server PROG=/usr/sbin/${NAME} -CONFIG=/etc/zabbix_server.conf +CONFIG=/etc/${NAME}.conf +USER=zabbix-server start_service() { + local enabled never_root + if [ ! -f "${CONFIG}" ]; then logger "Configuration file not found: '${CONFIG}'" return 1 @@ -20,6 +25,7 @@ start_service() { # Get enabled config option config_load "$NAME" config_get_bool enabled general enabled 0 + config_get_bool never_root general never_root 1 # shellcheck disable=SC2154 if [ "$enabled" -eq 0 ]; then @@ -27,12 +33,14 @@ start_service() { return 1 fi - mkdir -p /var/run/zabbix-server - chown zabbix-server:zabbix-server /var/run/zabbix-server + mkdir -p "/var/run/$USER" + chown $USER:$USER "/var/run/$USER" procd_open_instance procd_set_param command ${PROG} -c ${CONFIG} -f - procd_set_param user zabbix-server + if [ "$never_root" -eq 1 ]; then + procd_set_param user ${USER} + fi procd_set_param limits nofile="16384 100000" procd_set_param file ${CONFIG} procd_set_param respawn From 015bbbe1b223ab296a81d44af00031c72d80b681 Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Thu, 16 Jul 2026 21:01:36 -0400 Subject: [PATCH 5/9] zabbix: bring proxy to parity with server and agentd * Add config file patch for proxy * Add initscript for proxy * Update Makefile and support files to bring proxy to parity with agentd and server. Signed-off-by: Daniel F. Dickinson --- admin/zabbix/Makefile | 23 +++-- admin/zabbix/files/zabbix_proxy.config | 4 + admin/zabbix/files/zabbix_proxy.defaults | 3 + admin/zabbix/files/zabbix_proxy.init | 49 ++++++++++ ..._proxy-tweak-config-file-for-openwrt.patch | 98 +++++++++++++++++++ 5 files changed, 170 insertions(+), 7 deletions(-) create mode 100644 admin/zabbix/files/zabbix_proxy.config create mode 100644 admin/zabbix/files/zabbix_proxy.defaults create mode 100755 admin/zabbix/files/zabbix_proxy.init create mode 100644 admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile index 3718721f8c4ba..a35a03b3b42a6 100644 --- a/admin/zabbix/Makefile +++ b/admin/zabbix/Makefile @@ -454,7 +454,7 @@ define Build/Configure $(call Build/Configure/Default) endef -# We use spaces for continued lines so that is if continuation does not parse +# We use spaces for continued lines so that if continuation does not parse # properly we will get a hard error instead of subtle failure. define Build/Compile $(call Build/Compile/Default) @@ -522,22 +522,31 @@ endef define Package/zabbix-proxy/conffiles /etc/zabbix_proxy.conf +/etc/config/zabbix_proxy +endef + +define Package/zabbix-proxy/postinst +#!/bin/sh +[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_zabbix_proxy) && rm -f /etc/uci-defaults/90_zabbix_proxy +exit 0 endef define Package/zabbix-proxy/install $(INSTALL_DIR) $(1)/etc/zabbix_proxy.conf.d $(call Package/zabbix/install/sbin,$(1),proxy) $(call Package/zabbix/install/etc,$(1),proxy) + $(call Package/zabbix/install/init.d,$(1),proxy) + $(INSTALL_DIR) $(1)/etc/config + $(INSTALL_CONF) ./files/zabbix_proxy.config $(1)/etc/config/zabbix_proxy + $(INSTALL_DIR) $(1)/etc/uci-defaults + $(INSTALL_BIN) ./files/zabbix_proxy.defaults $(1)/etc/uci-defaults/90_zabbix_proxy endef -define Package/zabbix-proxy-basic-sqlite/conffiles -/etc/zabbix_proxy.conf -endef +Package/zabbix-proxy-basic-sqlite/conffiles=$(call Package/zabbix-proxy/conffiles) +Package/zabbix-proxy-basic-sqlite/postinst=$(call Package/zabbix-proxy/postinst) define Package/zabbix-proxy-basic-sqlite/install - $(INSTALL_DIR) $(1)/etc/zabbix_proxy.conf.d - $(call Package/zabbix/install/sbin,$(1),proxy) - $(call Package/zabbix/install/etc,$(1),proxy) + $(call Package/zabbix-proxy/install,$(1)) endef define Package/zabbix-server/conffiles diff --git a/admin/zabbix/files/zabbix_proxy.config b/admin/zabbix/files/zabbix_proxy.config new file mode 100644 index 0000000000000..8464b009855c8 --- /dev/null +++ b/admin/zabbix/files/zabbix_proxy.config @@ -0,0 +1,4 @@ + +config zabbix_proxy 'general' + option enabled 0 + # option never_root 1 diff --git a/admin/zabbix/files/zabbix_proxy.defaults b/admin/zabbix/files/zabbix_proxy.defaults new file mode 100644 index 0000000000000..346814c3feb2f --- /dev/null +++ b/admin/zabbix/files/zabbix_proxy.defaults @@ -0,0 +1,3 @@ +#!/bin/sh + +chown zabbix-proxy:zabbix-proxy /etc/zabbix_proxy.conf diff --git a/admin/zabbix/files/zabbix_proxy.init b/admin/zabbix/files/zabbix_proxy.init new file mode 100755 index 0000000000000..c2806387a9b47 --- /dev/null +++ b/admin/zabbix/files/zabbix_proxy.init @@ -0,0 +1,49 @@ +#!/bin/sh /etc/rc.common +# Copyright (C) 2008-2025 OpenWrt.org + +# shellcheck shell=busybox + +# shellcheck disable=SC2034 +START=59 + +# shellcheck disable=SC2034 +USE_PROCD=1 + +NAME=zabbix_proxy +PROG=/usr/sbin/${NAME} +CONFIG=/etc/${NAME}.conf +USER=zabbix-proxy + +start_service() { + local enabled never_root + + if [ ! -f "${CONFIG}" ]; then + logger "Configuration file not found: '${CONFIG}'" + return 1 + fi + + # Get enabled config option + config_load "$NAME" + config_get_bool enabled general enabled 0 + config_get_bool never_root general never_root 1 + + # shellcheck disable=SC2154 + if [ "$enabled" -eq 0 ]; then + logger "service not enabled in /etc/config/$NAME" + return 1 + fi + + mkdir -p "/var/run/$USER" + chown $USER:$USER "/var/run/$USER" + + procd_open_instance + procd_set_param command ${PROG} -c ${CONFIG} -f + if [ "$never_root" -eq 1 ]; then + procd_set_param user ${USER} + fi + procd_set_param file ${CONFIG} + procd_set_param respawn + procd_set_param stdout 1 + procd_set_param stderr 1 + procd_close_instance +} diff --git a/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch b/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch new file mode 100644 index 0000000000000..cd1abd201b8c1 --- /dev/null +++ b/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch @@ -0,0 +1,98 @@ +From c03db1c64e218fb2ef469ddb9705eff9f9d493e1 Mon Sep 17 00:00:00 2001 +From: "Daniel F. Dickinson" +Date: Thu, 16 Jul 2026 18:58:26 -0400 +Subject: zabbix_proxy: tweak config file for OpenWrt + +Created 2026-07-16. + +1. Use passive proxy mode by default (in keeping with agentd defaults). +2. Use system hostname as system hostname not 'Zabbix proxy'. +3. Log to syslog, not a file. +4. Update PidFile path so correct permissions can be set for access by + Zabbix proxy running without privileges. +5. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin). +6. Configure fping as the ipv6 fping as well. +7. If started as root, drop privileges to zabbix-proxy user (instead of + zabbix user shared with agent and server, or root) per upstream + recommendation: + https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation. +8. Include configurations under /etc/zabbix_proxy.conf.d/. +9. Require configurations under /etc/zabbix_proxy.conf.d/ end in .conf + (other files are ignored for configuration purposes). +--- + conf/zabbix_proxy.conf | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/conf/zabbix_proxy.conf ++++ b/conf/zabbix_proxy.conf +@@ -11,6 +11,7 @@ + # Mandatory: no + # Default: + # ProxyMode=0 ++ProxyMode=1 + + ### Option: Server + # If ProxyMode is set to active mode: +@@ -39,7 +40,7 @@ Server=127.0.0.1 + # Default: + # Hostname= + +-Hostname=Zabbix proxy ++# Hostname=Zabbix proxy + + ### Option: HostnameItem + # Item used for generating Hostname if it is undefined. +@@ -73,6 +74,7 @@ Hostname=Zabbix proxy + # Mandatory: no + # Default: + # LogType=file ++LogType=system + + ### Option: LogFile + # Log file name for LogType 'file' parameter. +@@ -81,7 +83,7 @@ Hostname=Zabbix proxy + # Default: + # LogFile= + +-LogFile=/tmp/zabbix_proxy.log ++# LogFile=/tmp/zabbix_proxy.log + + ### Option: LogFileSize + # Maximum size of log file in MB. +@@ -130,6 +132,7 @@ LogFile=/tmp/zabbix_proxy.log + # Mandatory: no + # Default: + # PidFile=/tmp/zabbix_proxy.pid ++PidFile=/var/run/zabbix-proxy/zabbix_proxy.pid + + ### Option: SocketDir + # IPC socket directory. +@@ -613,6 +616,7 @@ Timeout=4 + # Mandatory: no + # Default: + # FpingLocation=/usr/sbin/fping ++FpingLocation=/usr/bin/fping + + ### Option: Fping6Location + # Location of fping6. +@@ -622,6 +626,7 @@ Timeout=4 + # Mandatory: no + # Default: + # Fping6Location=/usr/sbin/fping6 ++Fping6Location= + + ### Option: SSHKeyLocation + # Location of public and private keys for SSH checks and actions. +@@ -667,6 +672,7 @@ LogSlowQueries=3000 + # Mandatory: no + # Default: + # User=zabbix ++User=zabbix-proxy + + ### Option: SSLCertLocation + # Location of SSL client certificates. +@@ -1051,3 +1057,4 @@ StatsAllowedIP=127.0.0.1 + # Include=/usr/local/etc/zabbix_proxy.general.conf + # Include=/usr/local/etc/zabbix_proxy.conf.d/ + # Include=/usr/local/etc/zabbix_proxy.conf.d/*.conf ++Include=/etc/zabbix_proxy.conf.d/*.conf From 7f8c1d64fb66758907f1487eb5df43d156462fff Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Thu, 16 Jul 2026 21:09:43 -0400 Subject: [PATCH 6/9] zabbix: preserve user config files across sysupgrade Add the user config file directories (/etc/zabbix_x.conf.d) to the list of directories and files to preserve across sysupgrade. Signed-off-by: Daniel F. Dickinson --- admin/zabbix/Makefile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile index a35a03b3b42a6..0533cd9be1976 100644 --- a/admin/zabbix/Makefile +++ b/admin/zabbix/Makefile @@ -493,6 +493,7 @@ endef define Package/zabbix-agentd/conffiles /etc/zabbix_agentd.conf +/etc/zabbix_agentd.conf.d /etc/config/zabbix_agentd endef @@ -513,8 +514,8 @@ define Package/zabbix-agentd/install $(INSTALL_BIN) ./files/zabbix_agentd.defaults $(1)/etc/uci-defaults/90_zabbix_agentd endef -Package/zabbix-agentd-basic/conffiles=$(call Package/zabbix_agentd/conffiles) -Package/zabbix-agentd-basic/postinst=$(call Package/zabbix_agentd/postinst) +Package/zabbix-agentd-basic/conffiles=$(call Package/zabbix-agentd/conffiles) +Package/zabbix-agentd-basic/postinst=$(call Package/zabbix-agentd/postinst) define Package/zabbix-agentd-basic/install $(call Package/zabbix-agentd/install,$(1)) @@ -522,6 +523,7 @@ endef define Package/zabbix-proxy/conffiles /etc/zabbix_proxy.conf +/etc/zabbix_proxy.conf.d /etc/config/zabbix_proxy endef @@ -551,6 +553,7 @@ endef define Package/zabbix-server/conffiles /etc/zabbix_server.conf +/etc/zabbix_server.conf.d /etc/config/zabbix_server /etc/sysctl.d/90-zabbix-discovery-workers.conf endef From 9c2f3aeeea92ecdbad46392a8f2fe347e78a8811 Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Thu, 16 Jul 2026 23:56:31 -0400 Subject: [PATCH 7/9] zabbix: move agentd openwrt-supplied params to separate dir Avoid treating openwrt-supplies params files as configuration data. Instead have them in a separate directory which is included in the zabbix_agentd configuration by default. Signed-off-by: Daniel F. Dickinson --- admin/zabbix/Makefile | 4 ++-- .../files/{ => zabbix_agentd.openwrt-params.d}/mac80211 | 0 .../zabbix/files/{ => zabbix_agentd.openwrt-params.d}/network | 0 admin/zabbix/files/{ => zabbix_agentd.openwrt-params.d}/wifi | 0 .../010-zabbix_agentd-tweak-config-file-for-openwrt.patch | 3 ++- 5 files changed, 4 insertions(+), 3 deletions(-) rename admin/zabbix/files/{ => zabbix_agentd.openwrt-params.d}/mac80211 (100%) rename admin/zabbix/files/{ => zabbix_agentd.openwrt-params.d}/network (100%) rename admin/zabbix/files/{ => zabbix_agentd.openwrt-params.d}/wifi (100%) diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile index 0533cd9be1976..b853d1dbc9ae5 100644 --- a/admin/zabbix/Makefile +++ b/admin/zabbix/Makefile @@ -487,8 +487,8 @@ define Package/zabbix/install/init.d endef define Package/zabbix/install/zabbix.conf.d - $(INSTALL_DIR) $(1)/etc/zabbix_agentd.conf.d - $(INSTALL_BIN) ./files/$(2) $(1)/etc/zabbix_agentd.conf.d/$(2) + $(INSTALL_DIR) $(1)/usr/share/zabbix_agentd.openwrt-params.d + $(INSTALL_BIN) ./files/zabbix_agentd.openwrt-params.d/$(2) $(1)/usr/share/zabbix_agentd.openwrt-params.d/$(2) endef define Package/zabbix-agentd/conffiles diff --git a/admin/zabbix/files/mac80211 b/admin/zabbix/files/zabbix_agentd.openwrt-params.d/mac80211 similarity index 100% rename from admin/zabbix/files/mac80211 rename to admin/zabbix/files/zabbix_agentd.openwrt-params.d/mac80211 diff --git a/admin/zabbix/files/network b/admin/zabbix/files/zabbix_agentd.openwrt-params.d/network similarity index 100% rename from admin/zabbix/files/network rename to admin/zabbix/files/zabbix_agentd.openwrt-params.d/network diff --git a/admin/zabbix/files/wifi b/admin/zabbix/files/zabbix_agentd.openwrt-params.d/wifi similarity index 100% rename from admin/zabbix/files/wifi rename to admin/zabbix/files/zabbix_agentd.openwrt-params.d/wifi diff --git a/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch index b95cf71803ae1..e79bd66a25599 100644 --- a/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch +++ b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch @@ -90,8 +90,9 @@ Signed-off-by: Daniel F. Dickinson ####### USER-DEFINED MONITORED PARAMETERS ####### -@@ -549,3 +557,4 @@ Hostname=Zabbix server +@@ -549,3 +557,5 @@ Hostname=Zabbix server # Include=/usr/local/etc/zabbix_agentd.userparams.conf # Include=/usr/local/etc/zabbix_agentd.conf.d/ # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf ++Include=/usr/share/zabbix_agentd.openwrt-params.d/ +Include=/etc/zabbix_agentd.conf.d/*.conf From 612b66a07c44bc692a31e62809b6336721834e74 Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Fri, 17 Jul 2026 02:28:30 -0400 Subject: [PATCH 8/9] zabbix: stop shipping sysctl.d conf in package The sysctl file increases max files to allow the default full complement of discovery workers, however this is probably not a hard requirement and such a conf not shipped elsewhere in tree, so leave that to the user to configure. (The syslog messages from zabbix-server and/or zabbix-proxy provided the needed information). Signed-off-by: Daniel F. Dickinson --- admin/zabbix/Makefile | 3 --- admin/zabbix/files/zabbix-discovery-workers.conf.sysctl | 1 - 2 files changed, 4 deletions(-) delete mode 100644 admin/zabbix/files/zabbix-discovery-workers.conf.sysctl diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile index b853d1dbc9ae5..1e1481007af66 100644 --- a/admin/zabbix/Makefile +++ b/admin/zabbix/Makefile @@ -555,7 +555,6 @@ define Package/zabbix-server/conffiles /etc/zabbix_server.conf /etc/zabbix_server.conf.d /etc/config/zabbix_server -/etc/sysctl.d/90-zabbix-discovery-workers.conf endef define Package/zabbix-server/install @@ -563,8 +562,6 @@ define Package/zabbix-server/install $(call Package/zabbix/install/sbin,$(1),server) $(call Package/zabbix/install/etc,$(1),server) $(call Package/zabbix/install/init.d,$(1),server) - $(INSTALL_DIR) $(1)/etc/sysctl.d - $(INSTALL_CONF) ./files/zabbix-discovery-workers.conf.sysctl $(1)/etc/sysctl.d/90-zabbix-discovery-workers.conf $(INSTALL_DIR) $(1)/etc/config $(INSTALL_CONF) ./files/zabbix_server.config $(1)/etc/config/zabbix_server $(INSTALL_DIR) $(1)/etc/uci-defaults diff --git a/admin/zabbix/files/zabbix-discovery-workers.conf.sysctl b/admin/zabbix/files/zabbix-discovery-workers.conf.sysctl deleted file mode 100644 index e88c23943f991..0000000000000 --- a/admin/zabbix/files/zabbix-discovery-workers.conf.sysctl +++ /dev/null @@ -1 +0,0 @@ -fs.file-max=100000 From ed755c1e7830d88b33ccce7ee0b3b18b456af961 Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Fri, 17 Jul 2026 02:48:36 -0400 Subject: [PATCH 9/9] zabbix: add php8-mod-simplexml dependency to frontend While the frontend can mostly operate without php8-mod-simplexml, when trying to import XML templates the user only gets unhelpful error messages and is unlikely to realize the module is required for that functionality. Therefore have the frontend depend on php8-mod-simplexml. Signed-off-by: Daniel F. Dickinson --- admin/zabbix/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile index 1e1481007af66..48ac577b336df 100644 --- a/admin/zabbix/Makefile +++ b/admin/zabbix/Makefile @@ -361,6 +361,7 @@ define Package/zabbix-frontend-server +php8-mod-mbstring \ +php8-mod-openssl \ +php8-mod-session \ + +php8-mod-simplexml \ +php8-mod-sockets \ +php8-mod-xmlreader \ +php8-mod-xmlwriter