Package: zabbix-agent Version: 1:1.1.4-10 Severity: important The zabbix-agentd process runs as user 'zabbix' by default, which is of course very desirable. However, the process' gid defaults to 0 (root) which did really surprise me. On systems using this group for administrative purposes, this (unconfigurable) default can yield a significant security risk.
This weird behaviour has another downside: it is impossible to configure additional groups for the zabbix-agentd process. Say you want a zabbix-agent script to parse some logfiles in /var/log, it is impossible to achieve this by only configuring the 'zabbix' user in group 'adm'. -- System Information: Debian Release: 4.0 APT prefers stable APT policy: (500, 'stable') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.18-4-xen-686 Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Versions of packages zabbix-agent depends on: ii adduser 3.102 Add and remove users and groups ii debconf [debconf-2.0] 1.5.11 Debian configuration management sy ii libc6 2.3.6.ds1-13 GNU C Library: Shared libraries ii libldap2 2.1.30-13.3 OpenLDAP libraries ii logrotate 3.7.1-3 Log rotation utility ii ucf 2.0020 Update Configuration File: preserv zabbix-agent recommends no packages. -- debconf information: zabbix-agent/server: -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
