Zabbix alert on root login

zabbix

I have started using Zabbix and can see it is throwing alerts when things are changed such as /etc/passwd.

Goggling for 'zabbix alert on root login' is not bringing up any pointers – How would I go about having an alert on root login please?

Best Answer

You shouldn't allow root logins altogether, because that's insecure. You should only allow regular user logins, and once logged in, the user can use sudo to execute commands as root.

That being said, why would you only check root logins? Checking regular user logins is just as important. Bots on the internet perform brute-force attacks for regular users all the time.

Either way, you need to check /var/log/auth.log for successful SSH logins. Checking log files requires active Zabbix agent checks. So first you need to make sure that active checks are working properly (see this blog post).

Secondly, the Zabbix user is (by default) running as the zabbix user. So it will not be able to read /var/log/auth.log, because that file is only readable by root and users in group adm. So you can add the zabbix user to the adm group. This allows Zabbix to read many log files (source).

Finally, you need to create a monitoring item and trigger in Zabbix frontend.

Create an item:

Name: SSH successful authentication
Type: Zabbix agent (active)
Key: log[/var/log/auth.log,"Accepted .*",,,skip,\0]

Create a trigger for that item:

Name: Successful SSH authentication on {HOST.NAME}
Expression: {Template OS Linux - Extra:log[/var/log/auth.log,"Accepted .*",,,skip,\0].strlen()}>0 and {Template OS Linux - Extra:log[/var/log/auth.log,"Accepted .*",,,skip,\0].nodata(5m)}=0

Notice the Accepted .* regular expression in the item. This should match all types of SSH authentication, be it password authentication, or public key authentication. Of course, in your case, you can change the regex to only match logins from root. But as explained earlier, this makes no sense from a security perspective.

Also notice that I used log[...], because this results in the responsible log line matched by the regex to be included in the notification email that Zabbix will send. That way, you can see in the email which user was authenticated.

Related Topic