hi,

I recently changed to zabbix agent2 to have the samrt plugin working. I tried to limit the sudoers because i dont want an issue on this plugin to mess with the disks.

I am prevented to do that because  the plugin do not use a standard way to launch the command smartctl.

For exemple it can launch

samrtctl --scan ...
smartctl -j ....

 the -j is a format options so it should be after the real option like -scan --all or other.

This way i can limit the smartctl in sudoer to the readonly commands. If you use format option in random place i cannot limit them.

So my request here is to put the action parameter as the first one so i can limit sudo usage to a subset of reading probes and forbid options like -s, -B  or -C etc..

i dont know if this is possible to secure that. I used zabbix 7.0.3.

ii  zabbix-agent2  1:7.0.3-1+ubuntu22.04 amd64        Zabbix network monitoring solution - agent

best regards,
Ghislain.

To get the version of the "smartctl" utility, we need to run the command "smartctl -j -V". If the parameters are switched, the version will be returned in plain text format instead of JSON. Therefore, in this case, we cannot place the "-j" option at the end of the command.

In other cases, the "-j" option is placed at the end of the command.

oh if this is the only one then we can make it work.

Thanks i will try this and come back.

regards,

Ghislain.

so

# pour ubuntu
zabbix ALL=(root) NOPASSWD: /usr/sbin/smartctl -a *, /usr/sbin/smartctl --all *, \
/usr/sbin/smartctl -H *, /usr/sbin/smartctl --health *, \
/usr/sbin/smartctl -i *, /usr/sbin/smartctl --info *, \
/usr/sbin/smartctl -x *, /usr/sbin/smartctl --xall *, \
/usr/sbin/smartctl -c *, /usr/sbin/smartctl --capabilities *, \
/usr/sbin/smartctl --scan *, /usr/sbin/smartctl -s *, \
/usr/sbin/smartctl -l error *, /usr/sbin/smartctl --log=error * , \
/usr/sbin/smartctl -j -V

 # pour debian
zabbix ALL=(root) NOPASSWD: /sbin/smartctl -a *, /sbin/smartctl --all *, \
/sbin/smartctl -H *, /sbin/smartctl --health *, \
/sbin/smartctl -i *, /sbin/smartctl --info *, \
/sbin/smartctl -x *, /sbin/smartctl --xall *, \
/sbin/smartctl -c *, /sbin/smartctl --capabilities *, \
/sbin/smartctl --scan *, /sbin/smartctl -s *, \
/sbin/smartctl -l error *, /sbin/smartctl --log=error *, \
/sbin/smartctl -j -V

should do it ?

Based on the code, the SMART plugin only uses these commands:

/usr/sbin/smartctl -a *
/usr/sbin/smartctl --scan *
/usr/sbin/smartctl -j -V

https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/src/go/plugins/smart/smartfs.go?at=refs%2Fheads%2Frelease%2F7.0

ok thanks a lot !

# pour ubuntu
zabbix ALL=(root) NOPASSWD: /usr/sbin/smartctl -a *, /usr/sbin/smartctl --all *, /usr/sbin/smartctl --scan *, /usr/sbin/smartctl -s *, /usr/sbin/smartctl -j -V

 # pour debian
zabbix ALL=(root) NOPASSWD: /sbin/smartctl -a *, /sbin/smartctl --all *, /sbin/smartctl --scan *, /sbin/smartctl -s *, /sbin/smartctl -j -V

and we are good.
Perhaps this could be added in the doc for thigher  sudofoo ?
best regards,
Ghsilain.

Hello aqueos 

Thank you, confirmed. 

Regards,

Edgar

FYI

i have a lot of zabbix agent crash and i wonder if the plugin here is a part of it:

https://support.zabbix.com/browse/ZBX-25172

the symptoms are  ram balooning to 50GO+ of the zabbix process. Each time a lot of smartctl process are in the wild waiting for sudo perhaps asking a password because of the rule i put.

are we sure that the plugin is not leaking ram ?

Also should sudo not be used with '-n' ?

-n, --non-interactive
  Avoid prompting the user for input of any kind.  If a password is required for the command to run, sudo will display an error message and exit.

 
is there any timeout on the execution of smartctl ?

regards,

Ghislain.

Please do not mix issues. This one is for enhancing sudo/permission example in the documentation. 

forget it it allready use -n

ok sorry.

aqueos One thing. Please, next time you create a ticket do not hesitate to fill in the description.

sorry the interface is slow and buggy to me in FF, i have ghostery and ublock origin deactivated and it should be better now.
Will try to be more precise also in version and all. Thanks for the help and quick answers

best regards,

Ghislain.

Documentation updated:

• Configuration -> Items -> Plugins in 6.0
• Extensions -> Plugins in 7.0, 7.2