zabbix_agentd: Disable passive checks by default on new installations.

Zabbix Agent by default normally forks 10 instances to listen for incoming (passive) checks.
I, however, recommend only using active checks on an IPFire instance, so that the agent on the instance will only actively contact the Zabbix server to request a list of checks to perform instead of waiting for the server to contact the agent for every check.
This frees up some resources valuable to smaller systems and makes the agent not to listen on any TCP port, which is a possible attack surface less.

Users with an existing installation will have to manually add the parameter to their config. This will be documented in the wiki.

Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/zabbix_agentd/zabbix_agentd.conf b/config/zabbix_agentd/zabbix_agentd.conf
index 4480e43f2b836955947f624e56dfa766f2db6900..a5a608d83c6ddc8aebcd1e0323b3e107b3a8a9cd 100644 (file)
--- a/config/zabbix_agentd/zabbix_agentd.conf
+++ b/config/zabbix_agentd/zabbix_agentd.conf
@@ -13,7 +13,16 @@
 Server=127.0.0.1
 ServerActive=127.0.0.1
 
-# List of comma delimited IP addresses that the agent should listen on.
+# Number of pre-forked instances of zabbix_agentd that process passive checks.
+# On IPFire this is set to 0 to disable passive checks and only allow active
+# checks by default.
+# Set this value in a range of 1-100 to enable passive checks or comment it
+# out to revert to the Zabbix agent default (10).
+StartAgents=0
+
+# List of comma delimited IP addresses that the agent should listen on
+# for passive checks. 
+# The agent will not listen on any TCP port when StartAgents is set to 0.
 ListenIP=GREEN_ADDRESS
 
 # This line activates IPFire specific userparameters.