From 6655a1f2e5bff8d0082f41cf2711339f0d75d788 Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Wed, 17 Dec 2025 06:39:16 -0500 Subject: zabbix_server: tweak config file for OpenWrt Created 2025-12-17. Updated 2026-07-16. 1. Log to syslog, not a file. 2. Update PidFile path so correct permissions can be set for access by Zabbix server running without privileges. 3. If started as root, drop privileges to zabbix-server user (instead of zabbix user shared with agent and proxy, or root) per upstream recommendation: https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation. 4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin). 5. Configure fping as the ipv6 fping as well. 6. For privacy, disable the public API call to check Zabbix version. 7. Include configurations under /etc/zabbix_server.conf.d/. 8. Require configurations under /etc/zabbix_server.conf.d/ end in .conf (other files are ignored for configuration purposes). Signed-off-by: Daniel F. Dickinson --- conf/zabbix_server.conf | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) --- a/conf/zabbix_server.conf +++ b/conf/zabbix_server.conf @@ -27,6 +27,7 @@ # Mandatory: no # Default: # LogType=file +LogType=system ### Option: LogFile # Log file name for LogType 'file' parameter. @@ -35,7 +36,7 @@ # Default: # LogFile= -LogFile=/tmp/zabbix_server.log +# LogFile=/tmp/zabbix_server.log ### Option: LogFileSize # Maximum size of log file in MB. @@ -67,6 +68,10 @@ LogFile=/tmp/zabbix_server.log # Default: # PidFile=/tmp/zabbix_server.pid +# Although procd does not require a pid file, zabbix uses the pidfile to +# shut down correctly on receipt of a TERM or INT signal. +PidFile=/var/run/zabbix-server/zabbix_server.pid + ### Option: SocketDir # IPC socket directory. # Directory to store IPC sockets used by internal Zabbix services. @@ -611,6 +616,7 @@ Timeout=4 # Mandatory: no # Default: # FpingLocation=/usr/sbin/fping +FpingLocation=/usr/bin/fping ### Option: Fping6Location # Location of fping6. @@ -620,6 +626,7 @@ Timeout=4 # Mandatory: no # Default: # Fping6Location=/usr/sbin/fping6 +Fping6Location= ### Option: SSHKeyLocation # Location of public and private keys for SSH checks and actions. @@ -699,6 +706,7 @@ LogSlowQueries=3000 # Mandatory: no # Default: # User=zabbix +User=zabbix-server ### Option: SSLCertLocation # Location of SSL client certificates. @@ -1050,7 +1058,7 @@ EnableGlobalScripts=0 # # Mandatory: no # Default: -# AllowSoftwareUpdateCheck=1 +AllowSoftwareUpdateCheck=0 ### Option: SMSDevices # List of comma delimited modem files allowed to use Zabbix server @@ -1125,3 +1133,4 @@ EnableGlobalScripts=0 # Include=/usr/local/etc/zabbix_server.general.conf # Include=/usr/local/etc/zabbix_server.conf.d/ # Include=/usr/local/etc/zabbix_server.conf.d/*.conf +Include=/etc/zabbix_server.conf.d/*.conf