Removed root group for zabbix user in all images. Using nmap without sudo permissions

This commit is contained in:
Alexey Pustovalov
2024-01-19 00:19:02 +09:00
parent 180c638483
commit bf8b26a5d8
56 changed files with 100 additions and 114 deletions

View File

@@ -15,7 +15,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git
ENV TERM=xterm \
ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \
MIBDIRS=/usr/share/snmp/mibs:/var/lib/zabbix/mibs MIBS=+ALL
MIBDIRS=/usr/share/snmp/mibs:/var/lib/zabbix/mibs MIBS=+ALL \
NMAP_PRIVILEGED=""
LABEL description="Zabbix server with MySQL database support" \
maintainer="alexey.pustovalov@zabbix.com" \
@@ -55,7 +56,6 @@ COPY --from=builder ["/tmp/zabbix-${ZBX_VERSION}/database/mysql/create_server.sq
RUN set -eux && \
INSTALL_PKGS="bash \
tini \
sudo \
traceroute \
nmap \
fping \
@@ -102,12 +102,13 @@ RUN set -eux && \
--system \
--comment "Zabbix monitoring system" \
-g zabbix \
-G root \
-G dialout \
--uid 1997 \
--shell /sbin/nologin \
--home-dir /var/lib/zabbix/ \
zabbix && \
echo "zabbix ALL=(root) NOPASSWD: /usr/bin/nmap" >> /etc/sudoers.d/zabbix && \
chgrp zabbix /usr/bin/nmap && \
setcap cap_net_raw+eip /usr/bin/nmap && \
mkdir -p /etc/zabbix && \
mkdir -p /var/lib/zabbix && \
mkdir -p /usr/lib/zabbix/alertscripts && \