CIS Zabbix Benchmark

This recommendation verifies that Zabbix is running the latest stable version on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Zabbix version
zabbix_server -V
zabbix_agentd -V

# Update Zabbix to latest stable
apt-get update && apt-get install --only-upgrade zabbix-server-pgsql zabbix-frontend-php zabbix-agent2
systemctl restart zabbix-server zabbix-agent2

This recommendation verifies that Zabbix runs as a dedicated non-root user on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Zabbix runs as dedicated user
ps -eo user,pid,comm | grep zabbix
grep -E '^AllowRoot|^User' /etc/zabbix/zabbix_server.conf

# Ensure Zabbix runs as non-root
# In zabbix_server.conf:
# AllowRoot=0
# User=zabbix
useradd -r -s /usr/sbin/nologin zabbix
chown -R zabbix:zabbix /etc/zabbix/

This recommendation verifies that HTTPS is configured for the web frontend on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify web frontend uses HTTPS
grep -rE 'SSLEngine|ssl_certificate' /etc/nginx/sites-enabled/ /etc/apache2/sites-enabled/ 2>/dev/null

# Configure HTTPS for Zabbix frontend
# Nginx example:
server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/certs/zabbix.pem;
    ssl_certificate_key /etc/ssl/private/zabbix-key.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
}

This recommendation verifies that external authentication (LDAP/SAML) is configured on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check authentication settings
grep -E 'authentication_type|ldap|saml' /etc/zabbix/zabbix_server.conf
# Check via API:
curl -s https://zabbix.example.com/api_jsonrpc.php -d '{"jsonrpc":"2.0","method":"authentication.get","params":{},"id":1}'

# Configure LDAP/SAML authentication
# In Zabbix UI: Administration -> Authentication
# Set authentication type to LDAP or SAML
# LDAP settings:
#   Host: ldaps://ldap.example.com
#   Base DN: dc=example,dc=com
#   Bind DN: cn=zabbix,ou=services,dc=example,dc=com
# Disable guest access in user group settings

This recommendation verifies that database connections use TLS with certificate verification on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check database TLS connection
grep -E 'DBTLSConnect|DBTLSCAFile|DBTLSCertFile' /etc/zabbix/zabbix_server.conf

# Configure database TLS
# In zabbix_server.conf:
# DBTLSConnect=verify_full
# DBTLSCAFile=/etc/zabbix/ssl/ca.pem
# DBTLSCertFile=/etc/zabbix/ssl/client-cert.pem
# DBTLSKeyFile=/etc/zabbix/ssl/client-key.pem

This recommendation verifies that agent communication uses TLS or PSK encryption on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check agent encryption
grep -E 'TLSConnect|TLSAccept|TLSPSKIdentity' /etc/zabbix/zabbix_agentd.conf

# Configure agent TLS/PSK encryption
# In zabbix_agentd.conf:
# TLSConnect=psk
# TLSAccept=psk
# TLSPSKIdentity=agent-host01
# TLSPSKFile=/etc/zabbix/zabbix_agentd.psk
# Generate PSK:
openssl rand -hex 32 > /etc/zabbix/zabbix_agentd.psk
chmod 600 /etc/zabbix/zabbix_agentd.psk

This recommendation verifies that server logging and log rotation are configured on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check server logging
grep -E 'LogFile|LogFileSize|DebugLevel' /etc/zabbix/zabbix_server.conf

# Configure comprehensive logging
# In zabbix_server.conf:
# LogFile=/var/log/zabbix/zabbix_server.log
# LogFileSize=100
# DebugLevel=3
# LogSlowQueries=3000
# Configure log rotation:
cat > /etc/logrotate.d/zabbix-server << 'EOF'
/var/log/zabbix/*.log {
    weekly
    rotate 12
    compress
    missingok
}
EOF

This recommendation verifies that audit logging is enabled on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit log settings via API
curl -s https://zabbix.example.com/api_jsonrpc.php -d '{"jsonrpc":"2.0","method":"settings.get","params":{"output":["auditlog_enabled"]},"id":1}'

# Enable audit logging
# In Zabbix UI: Administration -> General -> Audit log
# Enable audit logging = Yes
# Or via API:
# settings.update: auditlog_enabled=1
# Ensure housekeeping retains audit data for compliance period

This recommendation verifies that alerting actions with escalations are configured on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check user media types and actions
# List actions:
curl -s https://zabbix.example.com/api_jsonrpc.php -d '{"jsonrpc":"2.0","method":"action.get","params":{"output":["name","status"]},"id":1}'

# Configure alerting actions
# In Zabbix UI: Alerts -> Actions -> Trigger actions
# Create action with:
#   Conditions: Trigger severity >= High
#   Operations: Send to user group via email/webhook
# Disable unused media types
# Enable escalations for critical alerts

This recommendation verifies that global scripts are disabled and API tokens have expiry on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check API token settings
grep 'AllowUnsupportedDBVersions\|EnableGlobalScripts' /etc/zabbix/zabbix_server.conf

# Restrict API and script execution
# In zabbix_server.conf:
# EnableGlobalScripts=0
# AllowUnsupportedDBVersions=0
# In UI: Administration -> General -> API tokens
# Set token expiry dates
# Revoke unused tokens regularly

This setting ensures that network discovery is restricted to known subnets on the Zabbix monitoring platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Zabbix monitoring platform is essential for defense in depth.

# Check network discovery rules
# Via Zabbix API or UI: Configuration -> Discovery
curl -s https://zabbix.example.com/api_jsonrpc.php -d '{"jsonrpc":"2.0","method":"drule.get","params":{"output":"extend"},"id":1}'

# Restrict network discovery
# Limit discovery to specific subnets only
# Disable discovery rules not in active use
# Use SNMP v3 for discovery where possible
# Set appropriate discovery intervals (not too frequent)

This recommendation verifies that proxy communication uses certificate-based TLS on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check proxy configuration
grep -E 'Server=|TLSConnect|TLSAccept' /etc/zabbix/zabbix_proxy.conf 2>/dev/null

# Harden Zabbix proxy communication
# In zabbix_proxy.conf:
# TLSConnect=cert
# TLSAccept=cert
# TLSCAFile=/etc/zabbix/ssl/ca.pem
# TLSCertFile=/etc/zabbix/ssl/proxy-cert.pem
# TLSKeyFile=/etc/zabbix/ssl/proxy-key.pem
# Server=10.0.0.5

This recommendation verifies that data housekeeping retention policies are configured on the Zabbix monitoring platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zabbix monitoring platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check housekeeping settings
grep -E 'Housekeeping|MaxHousekeeperDelete' /etc/zabbix/zabbix_server.conf

# Configure data housekeeping
# In zabbix_server.conf:
# HousekeepingFrequency=1
# MaxHousekeeperDelete=5000
# In UI: Administration -> Housekeeping
# Set history/trend retention per item type
# Events: 365d, Trends: 365d, History: 90d

This setting ensures that configuration file permissions are restricted on the Zabbix monitoring platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Zabbix monitoring platform is essential for defense in depth.

# Check configuration file permissions
stat -c '%a %U %G' /etc/zabbix/zabbix_server.conf
find /etc/zabbix -type f -exec stat -c '%a %n' {} \;

# Restrict configuration file permissions
chmod 640 /etc/zabbix/zabbix_server.conf
chown root:zabbix /etc/zabbix/zabbix_server.conf
chmod 600 /etc/zabbix/zabbix_agentd.psk
chmod 640 /etc/zabbix/zabbix_agentd.conf