Add Zabbix agent rules

components/zabbix.yml

@@ -0,0 +1,7 @@
+name: zabbix
+packages:
+  - zabbix-agent
+rules:
+  - package_zabbix_agent_installed
+  - service_zabbix_agent_enabled
+  - zabbix_agent_server_configured

linux_os/guide/services/zabbix/group.yml

@@ -0,0 +1,8 @@
+documentation_complete: true
+
+title: 'Zabbix Agent'
+
+description: |-
+    Zabbix is a network monitoring solution used to monitor the
+    status and performance of servers. This section discusses how to
+    configure the Zabbix agent for best effect.

linux_os/guide/services/zabbix/package_zabbix_agent_installed/rule.yml

@@ -0,0 +1,20 @@
+documentation_complete: true
+
+title: 'Ensure Zabbix Agent Is Installed'
+
+description: |-
+    {{{ describe_package_install(package="zabbix-agent") }}}
+
+rationale: |-
+    The zabbix-agent package provides the Zabbix monitoring agent, which
+    reports system status and performance metrics to a central Zabbix
+    monitoring server.
+
+severity: medium
+
+{{{ complete_ocil_entry_package_installed("zabbix-agent") }}}
+
+template:
+    name: package_installed
+    vars:
+        pkgname: zabbix-agent

linux_os/guide/services/zabbix/service_zabbix_agent_enabled/rule.yml

@@ -0,0 +1,25 @@
+documentation_complete: true
+
+title: 'Ensure Zabbix Agent Is Enabled'
+
+description: |-
+    {{{ describe_service_enable(service="zabbix-agent") }}}
+
+rationale: |-
+    If the Zabbix agent is not running, the server cannot be monitored,
+    delaying detection of outages or performance issues.
+
+severity: medium
+
+ocil_clause: 'the zabbix-agent process is not running'
+
+ocil: |-
+    {{{ ocil_service_enabled(service="zabbix-agent") }}}
+
+fixtext: '{{{ fixtext_service_enabled(service="zabbix-agent") }}}'
+
+template:
+    name: service_enabled
+    vars:
+        servicename: zabbix-agent
+        packagename: zabbix-agent

linux_os/guide/services/zabbix/zabbix_agent_server_configured/oval/shared.xml

@@ -0,0 +1,55 @@
+<def-group>
+    <definition class="compliance" id="{{{ rule_id }}}" version="1">
+        {{{ oval_metadata("Zabbix agent should report to a designated server, not the packaged default", rule_title=rule_title) }}}
+        <criteria operator="AND">
+            <criterion test_ref="test_zabbix_server_set" comment="Server directive is configured" />
+            <criterion test_ref="test_zabbix_server_not_default" comment="Server directive is not left at 127.0.0.1" />
+            <criterion test_ref="test_zabbix_serveractive_set" comment="ServerActive directive is configured" />
+            <criterion test_ref="test_zabbix_serveractive_not_default" comment="ServerActive directive is not left at 127.0.0.1" />
+        </criteria>
+    </definition>
+
+    <ind:textfilecontent54_test id="test_zabbix_server_set" version="1"
+        check="all" check_existence="at_least_one_exists"
+        comment="Server directive is present in zabbix_agentd.conf">
+        <ind:object object_ref="object_zabbix_server_set"/>
+    </ind:textfilecontent54_test>
+    <ind:textfilecontent54_object id="object_zabbix_server_set" version="1">
+        <ind:filepath>/etc/zabbix/zabbix_agentd.conf</ind:filepath>
+        <ind:pattern operation="pattern match">^Server=\S+</ind:pattern>
+        <ind:instance datatype="int">1</ind:instance>
+    </ind:textfilecontent54_object>
+
+    <ind:textfilecontent54_test id="test_zabbix_server_not_default" version="1"
+        check="all" check_existence="none_exist"
+        comment="Server directive is not left at 127.0.0.1">
+        <ind:object object_ref="object_zabbix_server_not_default"/>
+    </ind:textfilecontent54_test>
+    <ind:textfilecontent54_object id="object_zabbix_server_not_default" version="1">
+        <ind:filepath>/etc/zabbix/zabbix_agentd.conf</ind:filepath>
+        <ind:pattern operation="pattern match">^Server=127\.0\.0\.1\s*$</ind:pattern>
+        <ind:instance datatype="int">1</ind:instance>
+    </ind:textfilecontent54_object>
+
+    <ind:textfilecontent54_test id="test_zabbix_serveractive_set" version="1"
+        check="all" check_existence="at_least_one_exists"
+        comment="ServerActive directive is present in zabbix_agentd.conf">
+        <ind:object object_ref="object_zabbix_serveractive_set"/>
+    </ind:textfilecontent54_test>
+    <ind:textfilecontent54_object id="object_zabbix_serveractive_set" version="1">
+        <ind:filepath>/etc/zabbix/zabbix_agentd.conf</ind:filepath>
+        <ind:pattern operation="pattern match">^ServerActive=\S+</ind:pattern>
+        <ind:instance datatype="int">1</ind:instance>
+    </ind:textfilecontent54_object>
+
+    <ind:textfilecontent54_test id="test_zabbix_serveractive_not_default" version="1"
+        check="all" check_existence="none_exist"
+        comment="ServerActive directive is not left at 127.0.0.1">
+        <ind:object object_ref="object_zabbix_serveractive_not_default"/>
+    </ind:textfilecontent54_test>
+    <ind:textfilecontent54_object id="object_zabbix_serveractive_not_default" version="1">
+        <ind:filepath>/etc/zabbix/zabbix_agentd.conf</ind:filepath>
+        <ind:pattern operation="pattern match">^ServerActive=127\.0\.0\.1\s*$</ind:pattern>
+        <ind:instance datatype="int">1</ind:instance>
+    </ind:textfilecontent54_object>
+</def-group>

linux_os/guide/services/zabbix/zabbix_agent_server_configured/rule.yml

@@ -0,0 +1,39 @@
+documentation_complete: true
+
+title: 'Ensure Zabbix Agent Reports To A Designated Server'
+
+description: |-
+    The Zabbix agent must be configured to report to the Zabbix server
+    corresponding to the network segment the host is on, by editing
+    <tt>Server</tt> and <tt>ServerActive</tt> in
+    <tt>/etc/zabbix/zabbix_agentd.conf</tt>:
+    <pre>Server=&lt;zabbix_server_address&gt;
+    ServerActive=&lt;zabbix_server_address&gt;</pre>
+
+rationale: |-
+    Leaving the agent at its packaged default (<tt>127.0.0.1</tt>) means it
+    is not actually reporting to any monitoring server, defeating the
+    purpose of having it installed.
+
+severity: medium
+
+warnings:
+    - general: |-
+        This rule doesn't come with a remediation; the correct Zabbix server
+        address depends on the network segment the host is on and needs to
+        be set by the administrator.
+
+ocil_clause: 'Server or ServerActive is missing or left at the packaged default'
+
+ocil: |-
+    Run the following command:
+    <pre># grep -E '^(Server|ServerActive)=' /etc/zabbix/zabbix_agentd.conf</pre>
+    Both <tt>Server</tt> and <tt>ServerActive</tt> should be present and set
+    to the Zabbix server address for this network segment, not left at the
+    packaged default of <tt>127.0.0.1</tt>.
+
+fixtext: |-
+    Edit <tt>/etc/zabbix/zabbix_agentd.conf</tt> and set <tt>Server</tt> and
+    <tt>ServerActive</tt> to the Zabbix server address for this network
+    segment. Restart the service:
+    <pre># systemctl restart zabbix-agent.service</pre>

linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/both_configured.pass.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# packages = zabbix-agent
+# platform = multi_platform_debian
+
+# Both Server and ServerActive point to a real monitoring server instead of
+# the packaged 127.0.0.1 default. Expected result: PASS.
+mkdir -p /etc/zabbix
+cat > /etc/zabbix/zabbix_agentd.conf <<EOF
+Server=192.168.1.10
+ServerActive=192.168.1.10
+EOF

linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/default_values.fail.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+# packages = zabbix-agent
+# platform = multi_platform_debian
+# remediation = none
+
+# Both directives are left at the packaged default of 127.0.0.1, so the
+# agent isn't actually reporting to any server. Expected result: FAIL.
+mkdir -p /etc/zabbix
+cat > /etc/zabbix/zabbix_agentd.conf <<EOF
+Server=127.0.0.1
+ServerActive=127.0.0.1
+EOF

linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/directives_missing.fail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = zabbix-agent
+# platform = multi_platform_debian
+# remediation = none
+
+# Neither Server nor ServerActive is present in the config file at all.
+# Expected result: FAIL.
+mkdir -p /etc/zabbix
+echo "# no Server/ServerActive directives" > /etc/zabbix/zabbix_agentd.conf

linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/server_default.fail.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+# packages = zabbix-agent
+# platform = multi_platform_debian
+# remediation = none
+
+# ServerActive is configured, but Server is still left at the packaged
+# 127.0.0.1 default. Expected result: FAIL.
+mkdir -p /etc/zabbix
+cat > /etc/zabbix/zabbix_agentd.conf <<EOF
+Server=127.0.0.1
+ServerActive=192.168.1.10
+EOF

linux_os/guide/services/zabbix/zabbix_agent_server_configured/tests/serveractive_default.fail.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+# packages = zabbix-agent
+# platform = multi_platform_debian
+# remediation = none
+
+# Server is configured, but ServerActive is still left at the packaged
+# 127.0.0.1 default. Expected result: FAIL.
+mkdir -p /etc/zabbix
+cat > /etc/zabbix/zabbix_agentd.conf <<EOF
+Server=192.168.1.10
+ServerActive=127.0.0.1
+EOF