tags 452682 + moreinfo
tags 452682 + unreproducible
thanks
hi Bas,
On Sat, Nov 24, 2007 at 03:43:40PM +0100, Bas van Schaik wrote:
> The zabbix-agentd process runs as user 'zabbix' by default, which is of
> course very desirable. However, the process' gid defaults to 0 (root)
> which did really surprise me. On systems using this group for
> administrative purposes, this (unconfigurable) default can yield a
> significant security risk.
i cant reproduce this. Installing zabbix-agent on a etch sytem results
in an agent running with uid and gid set to zabbix:
[EMAIL PROTECTED]:/tmp# ps -G zabbix -o user,group,pid
USER GROUP PID
zabbix zabbix 32428
zabbix zabbix 32429
looking at the sourcecode, zabbix does setgid and setuid if started
as root, can you confirm you dont have a error message telling you
about a failed setgid in your agents log?
/* running as root ?*/
if((getuid()==0) || (getgid()==0))
{
pwd = getpwnam("zabbix");
if ( pwd == NULL )
{
fprintf(stderr,"User zabbix does not exist.\n");
fprintf(stderr, "Cannot run as root !\n");
exit(FAIL);
}
if( (setgid(pwd->pw_gid) ==-1) || (setuid(pwd->pw_uid) == -1) )
{
fprintf(stderr,"Cannot setgid or setuid to zabbix
[%s]\n", strerror(errno));
exit(FAIL);
}
bye,
- michael
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
