[ZBX-17700] Enabling remote commands on Zabbix agent is very hard and misleading Created: 2020 May 11  Updated: 2024 Apr 10  Resolved: 2020 Jun 04

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G), Documentation (D)
Affects Version/s: 5.0.0rc1
Fix Version/s: 5.0.1rc1, 5.2.0alpha1, 5.2 (plan)

Type: Problem report Priority: Trivial
Reporter: Vladislavs Sokurenko Assignee: Andris Zeila
Resolution: Fixed Votes: 3
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Causes
caused by ZBXNEXT-1085 restrict available checks on the agen... Closed
Team: Team A
Sprint: Sprint 64 (May 2020)
Story Points: 0.5

 Description   

Take clean zabbix_agentd.conf, and read documentation that EnableRemoteCommands is deprecated

This parameter is deprecated, use AllowKey=system.run[*] or DenyKey=system.run[*] instead.

Add:

AllowKey=system.run[*]

See warning
zabbix_agentd [141208]: Warning: key access rule "system.run[*]" conflicts with another rule defined above
Test if it works:

zabbix_get -s 127.0.0.1 -k "system.run[echo 2]"
ZBX_NOTSUPPORTED: Unsupported item key.

For some reason it says unsupported item key but made sure that key is correct so it is not allowed

Try deleting DenyKey
See error:

zabbix_agentd [141243]: ERROR: "AllowKey" without "DenyKey" rules are meaningless

What can be done to enable remote command ? Documentation states simply

use AllowKey=system.run[*] or DenyKey=system.run[*]

So it looks like we need to add at least something to DenyKey ?
Add:

DenyKey=test

See:

zabbix_get -s 127.0.0.1 -k "system.run[echo 2]"
ZBX_NOTSUPPORTED: Remote commands are not enabled.

Still not working, how to enable remote commands there is only one option to do that but it is deprecated.
OK, try to use nevertheless

EnableRemoteCommands=1

See warning

Warning: EnableRemoteCommands parameter is deprecated, use AllowKey=system.run[*] or DenyKey=system.run[*] instead

But got it working

./bin/zabbix_get -s 127.0.0.1 -k "system.run[echo 2]"
2

Expected:
Documentation and logs must not be so misleading and it must not be so hard to enable remote commands and it must be possible to enable remote commands without deprecated option, please provide example at least.



 Comments   
Comment by Vladislavs Sokurenko [ 2020 May 11 ]

Also upgrade notes do not provide insights

The EnableRemoteCommands parameter is now deprecated. Remote commands are still disabled by default, but in the new configuration files that is expressed by using the new DenyKey parameter (DenyKey=system.run[*]). Remote commands can be enabled by removing (or commenting out) DenyKey=system.run[*] parameter.

It does not work and not clear what to do, commenting out DenyKey does not enable remote commands.

Comment by Vladislavs Sokurenko [ 2020 May 11 ]

Also there are no examples in Restricting agent checks on how to enable remote commands without disabling other keys.

Comment by richlv [ 2020 May 11 ]

Seems to partially duplicate ZBX-17586.

Comment by Sergejs Olonkins [ 2020 May 11 ]

Same problem also reported in ZBX-17367

Comment by Martins Valkovskis [ 2020 May 12 ]

The upgrade notes have been updated to reflect what appears to be the real situation. However, it does not resolve the issue because agent startup messages and also config files entries now contradict the documentation and perhaps also reality, as reported here and in some other tickets listed here.

Comment by Andris Zeila [ 2020 May 15 ]

Released ZBX-17700 in:

  • pre-5.0.1rc1 b60b366489
  • pre-5.2.0alpha1 6d4fcda213
Generated at Sat May 10 08:50:18 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.