From 2f22217f2de0c8e426b15c2e719e344e517ef0fc Mon Sep 17 00:00:00 2001 From: Israel Villar Boillos Date: Wed, 16 Sep 2026 21:55:55 +0100 Subject: [PATCH 1/3] Add Zabbix agent rules Zabbix is a widely used open-source network monitoring solution; the project already has SELinux booleans referencing it (sebool_httpd_can_connect_zabbix, sebool_zabbix_can_network) but no rules covering the monitoring agent itself. Adds a new zabbix service group with three rules: - package_zabbix_agent_installed and service_zabbix_agent_enabled (from templates). - zabbix_agent_server_configured: check-only, verifies Server and ServerActive are set in zabbix_agentd.conf and not left at the packaged 127.0.0.1 default. No remediation is shipped, since the correct monitoring server address is site-specific. Adds the zabbix component. Co-Authored-By: Claude Sonnet 5 --- components/zabbix.yml | 7 +++ linux_os/guide/services/zabbix/group.yml | 8 +++ .../package_zabbix_agent_installed/rule.yml | 20 +++++++ .../service_zabbix_agent_enabled/rule.yml | 25 +++++++++ .../oval/shared.xml | 55 +++++++++++++++++++ .../zabbix_agent_server_configured/rule.yml | 39 +++++++++++++ 6 files changed, 154 insertions(+) create mode 100644 components/zabbix.yml create mode 100644 linux_os/guide/services/zabbix/group.yml create mode 100644 linux_os/guide/services/zabbix/package_zabbix_agent_installed/rule.yml create mode 100644 linux_os/guide/services/zabbix/service_zabbix_agent_enabled/rule.yml create mode 100644 linux_os/guide/services/zabbix/zabbix_agent_server_configured/oval/shared.xml create mode 100644 linux_os/guide/services/zabbix/zabbix_agent_server_configured/rule.yml diff --git a/components/zabbix.yml b/components/zabbix.yml new file mode 100644 index 00000000000..d0f6f890a30 --- /dev/null +++ b/components/zabbix.yml @@ -0,0 +1,7 @@ +name: zabbix +packages: + - zabbix-agent +rules: + - package_zabbix_agent_installed + - service_zabbix_agent_enabled + - zabbix_agent_server_configured diff --git a/linux_os/guide/services/zabbix/group.yml b/linux_os/guide/services/zabbix/group.yml new file mode 100644 index 00000000000..895e8dcb69b --- /dev/null +++ b/linux_os/guide/services/zabbix/group.yml @@ -0,0 +1,8 @@ +documentation_complete: true + +title: 'Zabbix Agent' + +description: |- + Zabbix is a network monitoring solution used to monitor the + status and performance of servers. This section discusses how to + configure the Zabbix agent for best effect. diff --git a/linux_os/guide/services/zabbix/package_zabbix_agent_installed/rule.yml b/linux_os/guide/services/zabbix/package_zabbix_agent_installed/rule.yml new file mode 100644 index 00000000000..a576c0d2dc8 --- /dev/null +++ b/linux_os/guide/services/zabbix/package_zabbix_agent_installed/rule.yml @@ -0,0 +1,20 @@ +documentation_complete: true + +title: 'Ensure Zabbix Agent Is Installed' + +description: |- + {{{ describe_package_install(package="zabbix-agent") }}} + +rationale: |- + The zabbix-agent package provides the Zabbix monitoring agent, which + reports system status and performance metrics to a central Zabbix + monitoring server. + +severity: medium + +{{{ complete_ocil_entry_package_installed("zabbix-agent") }}} + +template: + name: package_installed + vars: + pkgname: zabbix-agent diff --git a/linux_os/guide/services/zabbix/service_zabbix_agent_enabled/rule.yml b/linux_os/guide/services/zabbix/service_zabbix_agent_enabled/rule.yml new file mode 100644 index 00000000000..29d7b7ec526 --- /dev/null +++ b/linux_os/guide/services/zabbix/service_zabbix_agent_enabled/rule.yml @@ -0,0 +1,25 @@ +documentation_complete: true + +title: 'Ensure Zabbix Agent Is Enabled' + +description: |- + {{{ describe_service_enable(service="zabbix-agent") }}} + +rationale: |- + If the Zabbix agent is not running, the server cannot be monitored, + delaying detection of outages or performance issues. + +severity: medium + +ocil_clause: 'the zabbix-agent process is not running' + +ocil: |- + {{{ ocil_service_enabled(service="zabbix-agent") }}} + +fixtext: '{{{ fixtext_service_enabled(service="zabbix-agent") }}}' + +template: + name: service_enabled + vars: + servicename: zabbix-agent + packagename: zabbix-agent diff --git a/linux_os/guide/services/zabbix/zabbix_agent_server_configured/oval/shared.xml b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/oval/shared.xml new file mode 100644 index 00000000000..f8b0e7acecd --- /dev/null +++ b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/oval/shared.xml @@ -0,0 +1,55 @@ + + + {{{ oval_metadata("Zabbix agent should report to a designated server, not the packaged default", rule_title=rule_title) }}} + + + + + + + + + + + + + /etc/zabbix/zabbix_agentd.conf + ^Server=\S+ + 1 + + + + + + + /etc/zabbix/zabbix_agentd.conf + ^Server=127\.0\.0\.1\s*$ + 1 + + + + + + + /etc/zabbix/zabbix_agentd.conf + ^ServerActive=\S+ + 1 + + + + + + + /etc/zabbix/zabbix_agentd.conf + ^ServerActive=127\.0\.0\.1\s*$ + 1 + + diff --git a/linux_os/guide/services/zabbix/zabbix_agent_server_configured/rule.yml b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/rule.yml new file mode 100644 index 00000000000..834df86657a --- /dev/null +++ b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/rule.yml @@ -0,0 +1,39 @@ +documentation_complete: true + +title: 'Ensure Zabbix Agent Reports To A Designated Server' + +description: |- + The Zabbix agent must be configured to report to the Zabbix server + corresponding to the network segment the host is on, by editing + Server and ServerActive in + /etc/zabbix/zabbix_agentd.conf: + 
Server=<zabbix_server_address>
+    ServerActive=<zabbix_server_address>
+ +rationale: |- + Leaving the agent at its packaged default (127.0.0.1) means it + is not actually reporting to any monitoring server, defeating the + purpose of having it installed. + +severity: medium + +warnings: + - general: |- + This rule doesn't come with a remediation; the correct Zabbix server + address depends on the network segment the host is on and needs to + be set by the administrator. + +ocil_clause: 'Server or ServerActive is missing or left at the packaged default' + +ocil: |- + Run the following command: + 
# grep -E '^(Server|ServerActive)=' /etc/zabbix/zabbix_agentd.conf
+ Both Server and ServerActive should be present and set + to the Zabbix server address for this network segment, not left at the + packaged default of 127.0.0.1. + +fixtext: |- + Edit /etc/zabbix/zabbix_agentd.conf and set Server and + ServerActive to the Zabbix server address for this network + segment. Restart the service: + 
# systemctl restart zabbix-agent.service
From c50ef06b74bf5a5015f2e3d963de8eece50d52d2 Mon Sep 17 00:00:00 2001 From: Israel Villar Boillos Date: Wed, 16 Sep 2026 22:11:36 +0100 Subject: [PATCH 2/3] Add Automatus test scenarios for zabbix_agent_server_configured zabbix_agent_server_configured has custom OVAL (not template-based), so it isn't covered by any template's built-in test suite. Adds 5 scenarios covering the AND of the four OVAL criteria: both directives configured (pass), both left at the packaged default, either directive missing entirely, and either directive individually left at default while the other is configured (fail). Verified with Automatus against the debian13 test container: all 5 scenarios evaluate as expected. Co-Authored-By: Claude Sonnet 5 --- .../tests/both_configured.pass.sh | 9 +++++++++ .../tests/default_values.fail.sh | 10 ++++++++++ .../tests/directives_missing.fail.sh | 7 +++++++ .../tests/server_default.fail.sh | 10 ++++++++++ .../tests/serveractive_default.fail.sh | 10 ++++++++++ 5 files changed, 46 insertions(+) create mode 100644 linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/both_configured.pass.sh create mode 100644 linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/default_values.fail.sh create mode 100644 linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/directives_missing.fail.sh create mode 100644 linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/server_default.fail.sh create mode 100644 linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/serveractive_default.fail.sh diff --git a/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/both_configured.pass.sh b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/both_configured.pass.sh new file mode 100644 index 00000000000..ecdcc11902e --- /dev/null +++ b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/both_configured.pass.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# packages = zabbix-agent +# platform = multi_platform_debian + +mkdir -p /etc/zabbix +cat > /etc/zabbix/zabbix_agentd.conf < /etc/zabbix/zabbix_agentd.conf < /etc/zabbix/zabbix_agentd.conf diff --git a/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/server_default.fail.sh b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/server_default.fail.sh new file mode 100644 index 00000000000..8221741417b --- /dev/null +++ b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/server_default.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# packages = zabbix-agent +# platform = multi_platform_debian +# remediation = none + +mkdir -p /etc/zabbix +cat > /etc/zabbix/zabbix_agentd.conf < /etc/zabbix/zabbix_agentd.conf < Date: Fri, 18 Sep 2026 06:58:25 +0100 Subject: [PATCH 3/3] Document expected results in zabbix_agent_server_configured tests Add a comment to each Automatus test scenario explaining what it exercises and the expected pass/fail outcome, as requested in review. Co-Authored-By: Claude Sonnet 5 --- .../tests/both_configured.pass.sh | 2 ++ .../zabbix_agent_server_configured/tests/default_values.fail.sh | 2 ++ .../tests/directives_missing.fail.sh | 2 ++ .../zabbix_agent_server_configured/tests/server_default.fail.sh | 2 ++ .../tests/serveractive_default.fail.sh | 2 ++ 5 files changed, 10 insertions(+) diff --git a/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/both_configured.pass.sh b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/both_configured.pass.sh index ecdcc11902e..9372a5c3052 100644 --- a/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/both_configured.pass.sh +++ b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/both_configured.pass.sh @@ -2,6 +2,8 @@ # packages = zabbix-agent # platform = multi_platform_debian +# Both Server and ServerActive point to a real monitoring server instead of +# the packaged 127.0.0.1 default. Expected result: PASS. mkdir -p /etc/zabbix cat > /etc/zabbix/zabbix_agentd.conf < /etc/zabbix/zabbix_agentd.conf < /etc/zabbix/zabbix_agentd.conf diff --git a/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/server_default.fail.sh b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/server_default.fail.sh index 8221741417b..2ef63ff3ab3 100644 --- a/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/server_default.fail.sh +++ b/linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/server_default.fail.sh @@ -3,6 +3,8 @@ # platform = multi_platform_debian # remediation = none +# ServerActive is configured, but Server is still left at the packaged +# 127.0.0.1 default. Expected result: FAIL. mkdir -p /etc/zabbix cat > /etc/zabbix/zabbix_agentd.conf < /etc/zabbix/zabbix_agentd.conf <