[PATCH 2/2] zabbix_agentd: Disable passive checks by default on new installations.

[Robin Roevens <robin.roevens@disroot.org>]

Zabbix Agent by default normally forks 10 instances to listen for incoming (passive) checks.
I, however, recommend only using active checks on an IPFire instance, so that the agent on the instance will only actively contact the Zabbix server to request a list of checks to perform instead of waiting for the server to contact the agent for every check.
This frees up some resources valuable to smaller systems and makes the agent not to listen on any TCP port, which is a possible attack surface less.

Users with an existing installation will have to manually add the parameter to their config. This will be documented in the wiki.

Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
---
 config/zabbix_agentd/zabbix_agentd.conf | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/config/zabbix_agentd/zabbix_agentd.conf b/config/zabbix_agentd/zabbix_agentd.conf
index 4480e43f2..a5a608d83 100644
--- a/config/zabbix_agentd/zabbix_agentd.conf
+++ b/config/zabbix_agentd/zabbix_agentd.conf
@@ -13,7 +13,16 @@
 Server=127.0.0.1
 ServerActive=127.0.0.1
 
-# List of comma delimited IP addresses that the agent should listen on.
+# Number of pre-forked instances of zabbix_agentd that process passive checks.
+# On IPFire this is set to 0 to disable passive checks and only allow active
+# checks by default.
+# Set this value in a range of 1-100 to enable passive checks or comment it
+# out to revert to the Zabbix agent default (10).
+StartAgents=0
+
+# List of comma delimited IP addresses that the agent should listen on
+# for passive checks. 
+# The agent will not listen on any TCP port when StartAgents is set to 0.
 ListenIP=GREEN_ADDRESS
 
 # This line activates IPFire specific userparameters. 
-- 
2.49.0


-- 
Dit bericht is gescanned op virussen en andere gevaarlijke
inhoud door MailScanner en lijkt schoon te zijn.