URL: https://linuxfr.org/users/ghusson/journaux/zabbix-autossh-systemd Title: Zabbix, autossh, systemd Authors: ghusson Date: 2016年04月09日T17:56:44+02:00 License: CC By-SA Tags: systemd, zabbix, autossh, debian, liberasys et tutoriel Score: 10 Bonjour, Suite à ce journal : https://linuxfr.org/users/m4rotte/journaux/snmp-vs-nrpe Je poste ici un howto pour autossh appliqué à Zabbix. But : avoir des communications chiffrées à travers SSH pour l'agent zabbix en actif et en passif et avoir un reverse tunnel ssh vers les machines avec agent. Il y a l'ID à faire varier pour chaque machine cliente. RQ : le chiffrement est intégré à Zabbix 3 maintenant. Donc il n'est plus trop souhaitable d'utiliser cette méthode. RQ : j'avais essayé d'utiliser des IP locales différentes pour chaque client (ex : 127.0.1.1) mais je n'y suis pas arrivé avec ssh. Donc j'ai fait varier les ports d'écoute. Et je me suis dit que 10.000 agents possible c'était déjà bien. ```bash CLIUSR=sshvpnzabbix CLIGRP=${CLIUSR} SRVIP= SRVPORT=22010 SRVUSR=${CLIUSR} SRVGRP=${CLIGRP} ``` **serveur (à faire une seule fois) :** ```bash # coller variables groupadd ${SRVGRP} useradd --create-home --gid ${SRVGRP} ${SRVUSR} passwd ${SRVUSR} # entrer un mot de passe et le conserver (keepass) ``` **client (à faire sur chaque client :** ```bash groupadd ${CLIGRP} useradd --create-home --gid ${CLIGRP} ${CLIUSR} su - ${CLIUSR} # recoller les variables ssh-keygen -t rsa -b 4096 -f ${SRVIP}_id_rsa_4096 # ne pas donner de mot de passe chmod 400 ${SRVIP}_id_rsa_4096* ssh-copy-id -p ${SRVPORT} -i ./${SRVIP}_id_rsa_4096.pub ${SRVUSR}@${SRVIP} ssh -p ${SRVPORT} -i ./${SRVIP}_id_rsa_4096 ${SRVUSR}@${SRVIP} # verifier dans .ssh/authorized_keys si tout est OK exit # deco ssh du serveur exit # retour a root en local sur le client ``` **configuration distribuée :** ```bash NODEID=3 service zabbix-server stop service apache2 stop sed -i "s/.*NodeID=.*/NodeID=${NODEID}/g" /etc/zabbix/zabbix_server.conf zabbix_server -n ${NODEID} -c /etc/zabbix/zabbix_server.conf service apache2 start #MASTER : admin -> DM #selectioner "node" dans la dropbox en haut à droite #vérifier paramètres neud local #créer un noeud service zabbix-server start ``` **autossh :** ```bash apt-get install autossh ASSHHOST= ASSHKPATH=/home/sshvpnzabbix/${ASSHHOST}_id_rsa_4096 TUNNELID=3 ASSHPORT=22010 ASSHLUSER=sshvpnzabbix ASSHDUSER=sshvpnzabbix # tunnel local(listen)->distant ASSHLDIP=127.0.0.1 ASSHLLPORT=$((30000+${TUNNELID})) ASSHLDPORT=10051 # tunnel distant(listen)->local ASSHRDIP=127.0.0.1 ASSHRLPORT=$((30000+${TUNNELID})) ASSHRDPORT=10051 # tunnel SSH distant(listen)->local ASSHRDIPSSH=127.0.0.1 ASSHRLPORTSSH=$((40000+${TUNNELID})) ASSHRDPORTSSH=22000 cat << 'EOF'> /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service [Unit] Description=Keeps a tunnel to '__ASSHHOST__' open, tunnel ID : '__TUNNELID__' After=network.target [Service] User=__ASSHLUSER__ # -p [PORT] # -l [user] # -M 0 --> no monitoring # -N Just open the connection and do nothing (not interactive) # LOCALPORT:IP_ON_EXAMPLE_COM:PORT_ON_EXAMPLE_COM Environment="AUTOSSH_GATETIME=0" "AUTOSSH_PORT=0" ExecStart=/usr/bin/autossh -M 0 -N -q -o "ServerAliveInterval 60" -o "ServerAliveCountMax 3" -p __ASSHPORT__ -L __ASSHLLPORT__:__ASSHLDIP__:__ASSHLDPORT__ -R __ASSHRLPORT__:__ASSHRDIP__:__ASSHRDPORT__ -R __ASSHRLPORTSSH__:__ASSHRDIPSSH__:__ASSHRDPORTSSH__ -i __ASSHKPATH__ __ASSHDUSER__@__ASSHHOST__ [Install] WantedBy=multi-user.target EOF chmod 644 /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHHOST__|${ASSHHOST}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHKPATH__|${ASSHKPATH}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__TUNNELID__|${TUNNELID}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHPORT__|${ASSHPORT}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHLUSER__|${ASSHLUSER}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHDUSER__|${ASSHDUSER}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHLDIP__|${ASSHLDIP}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHLLPORT__|${ASSHLLPORT}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHLDPORT__|${ASSHLDPORT}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHRDIP__|${ASSHRDIP}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHRLPORT__|${ASSHRLPORT}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHRDPORT__|${ASSHRDPORT}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHRDIPSSH__|${ASSHRDIPSSH}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHRLPORTSSH__|${ASSHRLPORTSSH}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service sed -i "s|__ASSHRDPORTSSH__|${ASSHRDPORTSSH}|g" /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service chmod 644 /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service systemctl --system daemon-reload systemctl start sshtunel_${ASSHHOST}_${TUNNELID}.service systemctl enable sshtunel_${ASSHHOST}_${TUNNELID}.service ``` **supprimer le service** ```bash systemctl stop sshtunel_${ASSHHOST}_${TUNNELID}.service systemctl disable sshtunel_${ASSHHOST}_${TUNNELID}.service rm /etc/systemd/system/sshtunel_${ASSHHOST}_${TUNNELID}.service ```