Handy Tips #10: Zabbix agent item Allow and Deny lists

Anonymous Anonymous

Zabbix Certified Expert & Trainer

November 4, 2021

Restrict access to sensitive information by defining Zabbix agent item Allow and Deny lists. Zabbix agent enables Zabbix users to collect a multitude of metrics. In some environments collection of a particular metric should be restricted to prevent access to confidential data. Zabbix Agent Allow and Deny lists enable users to define flexible metric collection […]

Restrict access to sensitive information by defining Zabbix agent item Allow and Deny lists.

Zabbix agent enables Zabbix users to collect a multitude of metrics. In some environments collection of a particular metric should be restricted to prevent access to confidential data.

Zabbix Agent Allow and Deny lists enable users to define flexible metric collection rules:

Restrict permitted item keys with an Allow or Deny list
Restrictions can be defined individually on each Zabbix agent
Users can restrict specific item keys or define restrictions based on item key patterns

Allow and Deny lists are supported on both Zabbix agent and Zabbix agent 2
Allow and Deny lists are supported starting from Zabbix version 5.0

Check out the video to learn how to configure an Allow and Deny list on your Zabbix agent.

How to configure Zabbix agent item Allow and Deny lists:

Navigate to Zabbix agent configuration file location
Open the Zabbix agent configuration file
Define the DenyKey – DenyKey=vfs.file.contents[/etc/*]
Define the AllowKey above the DenyKey –
AllowKey=vfs.file.contents[/etc/os-release]
Apply the changes by restarting the Zabbix agent
Test the items with the Zabbix agent test command line parameter
Test the access to the confidential file: zabbix_agentd -t
vfs.file.contents[/etc/passwd]
Test the access to the public file: zabbix_agentd -t
vfs.file.contents[/etc/os-release]
Check the item status in the Zabbix frontend

Tips and best practices:

All system.run[*] items are denied by default.
Use AllowKey=system.run[*] to allow remote commands
A whitelist without a deny rule is allowed only for system.run[*]
A denied item will become unsupported in the Zabbix frontend
The order of how rules are defined matters
When collecting an item, Zabbix agent will use the first matching Allow or Deny rule
An unlimited number of Allow and Deny rules can be defined
Allow and Deny rules do not affect HostnameItem, HostMetadataItem and HostInterfaceItem