cukw6666

如何在Ubuntu 20.04上安装和配置Zabbix以安全地监视远程服务器

The author selected the Computer History Museum to receive a donation as part of the Write for DOnations program.

作者选择“ 计算机历史博物馆”作为“ Write for DOnations”计划的一部分接受捐赠。

介绍 (Introduction)

Zabbix is open-source monitoring software for networks and applications. It offers real-time monitoring of thousands of metrics collected from servers, virtual machines, network devices, and web applications. These metrics can help you determine the current health of your IT infrastructure and detect problems with hardware or software components before customers complain. Useful information is stored in a database so you can analyze data over time and improve the quality of provided services or plan upgrades of your equipment.

Zabbix是用于网络和应用程序的开源监视软件。它提供对从服务器，虚拟机，网络设备和Web应用程序收集的数千个指标的实时监视。这些指标可以帮助您确定IT基础架构的当前运行状况，并在客户抱怨之前检测硬件或软件组件的问题。有用的信息存储在数据库中，因此您可以随时间分析数据并提高所提供服务的质量或计划设备的升级。

Zabbix uses several options for collecting metrics, including agentless monitoring of user services and client-server architecture. To collect server metrics, it uses a small agent on the monitored client to gather data and send it to the Zabbix server. Zabbix supports encrypted communication between the server and connected clients, so your data is protected while it travels over insecure networks.

Zabbix使用多种选项来收集指标，包括对用户服务和客户端-服务器体系结构的无代理监视。为了收集服务器指标，它在受监视的客户端上使用小型代理来收集数据并将其发送到Zabbix服务器。 Zabbix支持服务器与连接的客户端之间的加密通信，因此在不安全的网络上传输数据时，您的数据将受到保护。

The Zabbix server stores its data in a relational database powered by MySQL or PostgreSQL. You can also store historical data in NoSQL databases like Elasticsearch and TimescaleDB. Zabbix provides a web interface so you can view data and configure system settings.

Zabbix服务器将其数据存储在由MySQL或PostgreSQL支持的关系数据库中。您还可以将历史数据存储在NoSQL数据库(例如Elasticsearch和TimescaleDB)中。 Zabbix提供了一个Web界面，因此您可以查看数据和配置系统设置。

In this tutorial, you will configure Zabbix on two Ubuntu 20.04 machines. One will be configured as the Zabbix server, and the other as a client that you’ll monitor. The Zabbix server will use a MySQL database to record monitoring data and use Nginx to serve the web interface.

在本教程中，您将在两台Ubuntu 20.04计算机上配置Zabbix。一台将配置为Zabbix服务器，另一台将配置为您将监视的客户端。 Zabbix服务器将使用MySQL数据库记录监视数据，并使用Nginx服务Web界面。

先决条件 (Prerequisites)

To follow this tutorial, you will need:

要遵循本教程，您将需要：

Two Ubuntu 20.04 servers set up by following the Initial Server Setup Guide for Ubuntu 20.04, including a non-root user with sudo privileges and a firewall configured with ufw. On one server, you will install Zabbix; this tutorial will refer to this as the Zabbix server. It will monitor your second server; this second server will be referred to as the second Ubuntu server.
遵循《 Ubuntu 20.04初始服务器设置指南》设置了两台Ubuntu 20.04服务器，其中包括具有sudo特权的非root用户和使用ufw配置的防火墙。在一台服务器上，您将安装Zabbix。本教程将其称为Zabbix服务器 。它将监视您的第二台服务器；第二台服务器将被称为第二台Ubuntu服务器 。
The server that will run the Zabbix server needs Nginx, MySQL, and PHP installed. Follow Steps 1–3 of our Ubuntu 20.04 LEMP Stack guide to configure those on your Zabbix server.
将运行Zabbix服务器的服务器需要安装Nginx，MySQL和PHP。按照我们的Ubuntu 20.04 LEMP Stack指南的步骤1-3，在您的Zabbix服务器上进行配置。
A registered domain name. This tutorial will use your_domain throughout. You can purchase a domain name from Namecheap, get one for free with Freenom, or use the domain registrar of your choice.
注册域名。本教程将整个使用your_domain 。你可以购买一个域名Namecheap ，免费获得一个与Freenom ，或使用你选择的域名注册商。
Both of the following DNS records set up for your Zabbix server. If you are using DigitalOcean, please see our DNS documentation for details on how to add them.

以下两个DNS记录均已为您的Zabbix服务器设置。如果您使用的是DigitalOcean，请参阅我们的DNS文档以获取有关如何添加它们的详细信息。
- An A record with your_domain pointing to your Zabbix server’s public IP address.
  A记录，其中your_domain指向您的Zabbix服务器的公共IP地址。
- An A record with www.your_domain pointing to your Zabbix server’s public IP address.
  与www. your_domain的A记录www. your_domain www. your_domain指向您的Zabbix服务器的公共IP地址。

Additionally, because the Zabbix Server is used to access valuable information about your infrastructure that you would not want unauthorized users to access, it’s important that you keep your server secure by installing a TLS/SSL certificate. This is optional but strongly encouraged. If you would like to secure your server, follow the Let’s Encrypt on Ubuntu 20.04 guide after Step 3 of this tutorial.

此外，由于Zabbix服务器用于访问您不希望未经授权的用户访问的有关基础结构的有价值的信息，因此，通过安装TLS / SSL证书来确保服务器的安全非常重要。这是可选的，但强烈建议您这样做。如果您想保护服务器安全，请遵循本教程第3步之后的“在Ubuntu 20.04上让我们加密”指南。

第1步-安装Zabbix服务器 (Step 1 — Installing the Zabbix Server)

First, you need to install Zabbix on the server where you installed MySQL, Nginx, and PHP. Log in to this machine as your non-root user:

首先，您需要在安装MySQL，Nginx和PHP的服务器上安装Zabbix。以您的非root用户身份登录到此计算机：

ssh sammy@zabbix_server_ip_address
ssh sammy @ zabbix_server_ip_address

Zabbix is available in Ubuntu’s package manager, but it’s outdated, so use the official Zabbix repository to install the latest stable version. Download and install the repository configuration package:

Zabbix在Ubuntu的软件包管理器中可用，但是已经过时了，因此请使用官方的Zabbix存储库来安装最新的稳定版本。下载并安装存储库配置包：

wget https://repo.zabbix.com/zabbix/5.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_5.0-1+focal_all.deb
wget https://repo.zabbix.com/zabbix/5.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_ 5.0-1 + focal_all.deb
sudo dpkg -i zabbix-release_5.0-1+focal_all.deb
须藤dpkg -i zabbix -release_ 5.0-1 + focal_all.deb

You will see the following output:

您将看到以下输出：


   
   
     
     
     
     
      
      
      
      
    
    Output
   
   
     
     
     
     Selecting previously unselected package zabbix-release.
(Reading database ... 64058 files and directories currently installed.)
Preparing to unpack zabbix-release_5.0-1+focal_all.deb ...
Unpacking zabbix-release (1:5.0-1+focal) ...
Setting up zabbix-release (1:5.0-1+focal) ...

Update the package index so the new repository is included:

更新软件包索引，以便包括新的存储库：

sudo apt update
sudo apt更新

Then install the Zabbix server and web frontend with MySQL database support:

然后安装带有MySQL数据库支持的Zabbix服务器和Web前端：

sudo apt install zabbix-server-mysql zabbix-frontend-php
sudo apt安装zabbix-server-mysql zabbix-frontend-php

Also, install the Zabbix agent, which will let you collect data about the Zabbix server status itself.

另外，安装Zabbix代理，它将允许您收集有关Zabbix服务器状态本身的数据。

sudo apt install zabbix-agent
sudo apt安装zabbix-agent

Before you can use Zabbix, you have to set up a database to hold the data that the Zabbix server will collect from its agents. You can do this in the next step.

在使用Zabbix之前，您必须建立一个数据库来保存Zabbix服务器将从其代理收集的数据。您可以在下一步中执行此操作。

第2步-为Zabbix配置MySQL数据库 (Step 2 — Configuring the MySQL Database for Zabbix)

You need to create a new MySQL database and populate it with some basic information in order to make it suitable for Zabbix. You’ll also create a specific user for this database so Zabbix isn’t logging in to MySQL with the root account.

您需要创建一个新MySQL数据库并使用一些基本信息填充它，以使其适合Zabbix。您还将为此数据库创建一个特定的用户，以便Zabbix不会使用root帐户登录到MySQL。

以root用户登录MySQL：

sudo mysql
须藤MySQL

Create the Zabbix database with UTF-8 character support:

创建具有UTF-8字符支持的Zabbix数据库：

create database zabbix character set utf8 collate utf8_bin;
创建数据库zabbix字符集utf8整理utf8_bin;

Then create a user that the Zabbix server will use, give it access to the new database, and set the password for the user:

然后创建一个Zabbix服务器将使用的用户，授予它对新数据库的访问权限，并设置该用户的密码：

create user zabbix@localhost identified by 'your_zabbix_mysql_password';
创建用户ZABBIX @localhost鉴定“your_zabbix_mysql_password”;
grant all privileges on zabbix.* to zabbix@localhost;
将zabbix。*的所有特权授予zabbix @localhost;

That takes care of the user and the database. Exit out of the database console.

那会照顾用户和数据库。退出数据库控制台。

quit;
退出;

Next you have to import the initial schema and data. The Zabbix installation provided you with a file that sets this up.

接下来，您必须导入初始架构和数据。 Zabbix安装为您提供了一个设置文件。

Run the following command to set up the schema and import the data into the zabbix database. Use zcat since the data in the file is compressed:

运行以下命令来设置架构并将数据导入到zabbix数据库中。使用zcat因为文件中的数据已压缩：

zcat /usr/share/doc/zabbix-server-mysql*/create.sql.gz | mysql -uzabbix -p zabbix
zcat /usr/share/doc/zabbix-server-mysql*/create.sql.gz | mysql -uzabbix -p zabbix

Enter the password for the zabbix MySQL user that you configured when prompted.

输入在提示时配置的zabbix MySQL用户的密码。

This command may take a minute or two to execute. If you see the error ERROR 1045 (28000): Access denied for userzabbix@'localhost' (using password: YES) then make sure you used the right password for the zabbix user.

该命令可能需要一两分钟才能执行。如果看到错误ERROR 1045 (28000): Access denied for user zabbix @'localhost' (using password: YES) ERROR 1045 (28000): Access denied for user @'localhost' (using password: YES)确保为zabbix用户使用了正确的密码。

In order for the Zabbix server to use this database, you need to set the database password in the Zabbix server configuration file. Open the configuration file in your preferred text editor. This tutorial will use nano:

为了让Zabbix服务器使用此数据库，您需要在Zabbix服务器配置文件中设置数据库密码。在首选的文本编辑器中打开配置文件。本教程将使用nano ：

sudo nano /etc/zabbix/zabbix_server.conf
须藤纳米/etc/zabbix/zabbix_server.conf

Look for the following section of the file:

查找文件的以下部分：

/etc/zabbix/zabbix_server.conf

...
### Option: DBPassword                           
#       Database password. Ignored for SQLite.   
#       Comment this line if no password is used.
#                                                
# Mandatory: no                                  
# Default:                                       
# DBPassword=
...

These comments in the file explain how to connect to the database. You need to set the DBPassword value in the file to the password for your database user. Add this line after those comments to configure the database:

文件中的这些注释说明了如何连接到数据库。您需要将文件中的DBPassword值设置为数据库用户的密码。在这些注释之后添加以下行以配置数据库：

/etc/zabbix/zabbix_server.conf

...
DBPassword=your_zabbix_mysql_password
...

Save and close zabbix_server.conf by pressing CTRL+X, followed by Y and then ENTER if you’re using nano.

保存并关闭zabbix_server.conf是按CTRL+X ，然后按Y ，然后按ENTER如果您使用的是nano 。

You’ve now configured the Zabbix server to connect to the database. Next, you will configure the Nginx web server to serve the Zabbix frontend.

现在，您已经配置了Zabbix服务器以连接到数据库。接下来，您将配置Nginx Web服务器以服务Zabbix前端。

步骤3 —为Zabbix配置Nginx (Step 3 — Configuring Nginx for Zabbix)

To configure Nginx automatically, install the automatic configuration package:

要自动配置Nginx，请安装自动配置包：

sudo apt install zabbix-nginx-conf
sudo apt安装zabbix-nginx-conf

As a result, you will get the configuration file /etc/zabbix/nginx.conf, as well as a link to it in the Nginx configuration directory /etc/nginx/conf.d/zabbix.conf.

结果，您将获得配置文件/etc/zabbix/nginx.conf以及在Nginx配置目录/etc/nginx/conf.d/zabbix.conf 。

Next, you need to make changes to this file. Open the configuration file:

接下来，您需要对此文件进行更改。打开配置文件：

sudo nano /etc/zabbix/nginx.conf
须藤纳米/etc/zabbix/nginx.conf

The file contains an automatically generated Nginx server block configuration. It contains two lines that determine the server name and what port it is listening on:

该文件包含自动生成的Nginx服务器块配置。它包含两行，用于确定服务器名称和它侦听的端口：

/etc/zabbix/nginx.conf

server {
#        listen          80;
#        server_name     example.com;
...

Uncomment the two lines, and replace example.com with your domain name. Your settings will look like this:

取消注释这两行，并用您的域名替换example.com 。您的设置将如下所示：

/etc/zabbix/nginx.conf

server {
        listen          80;
        server_name     your_domain;
...

Save and close the file. Next, test to make sure that there are no syntax errors in any of your Nginx files and reload the configuration:

保存并关闭文件。接下来，测试以确保您的所有Nginx文件中都没有语法错误，然后重新加载配置：

sudo nginx -t
须藤Nginx -t
sudo nginx -s reload
sudo nginx -s重新加载

Now that Nginx is set up to serve the Zabbix frontend, you will make some modifications to your PHP setup in order for the Zabbix web interface to work properly.

现在已经设置了Nginx来服务Zabbix前端，您将对PHP设置进行一些修改，以使Zabbix Web界面正常工作。

Note: As mentioned in the Prerequisites section, it is recommended that you enable SSL/TLS on your server. If you would like to do this, follow our Ubuntu 20.04 Let’s Encrypt tutorial before you move on to Step 4 to obtain a free SSL certificate for Nginx. This process will automatically detect your Zabbix server block and configure it for HTTPS. After obtaining your SSL/TLS certificates, you can come back and complete this tutorial.

注意：如“先决条件”部分所述，建议您在服务器上启用SSL / TLS。如果要执行此操作，请继续执行我们的Ubuntu 20.04 Let's Encrypt教程，然后继续执行步骤4，以获取Nginx的免费SSL证书。此过程将自动检测您的Zabbix服务器块并将其配置为HTTPS。获得SSL / TLS证书后，您可以返回并完成本教程。

第4步-为Zabbix配置PHP (Step 4 — Configuring PHP for Zabbix)

The Zabbix web interface is written in PHP and requires some special PHP server settings. The Zabbix installation process created a PHP-FPM configuration file that contains these settings. It is located in the directory /etc/zabbix and is loaded automatically by PHP-FPM. You need to make a small change to this file, so open it up with the following:

Zabbix Web界面是用PHP编写的，并且需要一些特殊PHP服务器设置。 Zabbix安装过程创建了一个包含这些设置的PHP-FPM配置文件。它位于目录/etc/zabbix ，并由PHP-FPM自动加载。您需要对此文件进行一些小的更改，因此请使用以下命令将其打开：

sudo nano /etc/zabbix/php-fpm.conf
须藤纳米/etc/zabbix/php-fpm.conf

The file contains PHP settings that meet the necessary requirements for the Zabbix web interface. However, the timezone setting is commented out by default. To make sure that Zabbix uses the correct time, you need to set the appropriate timezone:

该文件包含满足Zabbix Web界面必要要求PHP设置。但是，默认情况下已注释掉时区设置。为了确保Zabbix使用正确的时间，您需要设置适当的时区：

/etc/zabbix/php-fpm.conf

...
php_value[max_execution_time] = 300
php_value[memory_limit] = 128M
php_value[post_max_size] = 16M
php_value[upload_max_filesize] = 2M
php_value[max_input_time] = 300
php_value[max_input_vars] = 10000
; php_value[date.timezone] = Europe/Riga

Uncomment the timezone line highlighted in the preceding code block and change it to your timezone. You can use this list of supported time zones to find the right one for you. Then save and close the file.

取消注释前面代码块中突出显示的时区行，并将其更改为您的时区。您可以使用此支持的时区列表为您找到合适的时区。然后保存并关闭文件。

Now restart PHP-FPM to apply these new settings:

现在重新启动PHP-FPM以应用以下新设置：

sudo systemctl restart php7.4-fpm.service
sudo systemctl重新启动php 7.4 -fpm.service

You can now start the Zabbix server:

现在，您可以启动Zabbix服务器：

sudo systemctl start zabbix-server
sudo systemctl启动zabbix服务器

Then check whether the Zabbix server is running properly:

然后检查Zabbix服务器是否正常运行：

sudo systemctl status zabbix-server
sudo systemctl状态zabbix服务器

You will see the following status:

您将看到以下状态：


   
   
     
     
     
     
      
      
      
      
    
    Output
   
   
     
     
     
     ● zabbix-server.service - Zabbix Server
     Loaded: loaded (/lib/systemd/system/zabbix-server.service; disabled; vendor preset: enabled)
     Active: active (running) since Fri 2020-06-12 05:59:32 UTC; 36s ago
    Process: 27026 ExecStart=/usr/sbin/zabbix_server -c $CONFFILE (code=exited, status=0/SUCCESS)
  ...

Finally, enable the server to start at boot time:

最后，启用服务器在引导时启动：

sudo systemctl enable zabbix-server
sudo systemctl启用zabbix服务器

The server is set up and connected to the database. Next, set up the web frontend.

服务器已设置并连接到数据库。接下来，设置Web前端。

第5步—配置Zabbix Web界面的设置 (Step 5 — Configuring Settings for the Zabbix Web Interface)

The web interface lets you see reports and add hosts that you want to monitor, but it needs some initial setup before you can use it. Launch your browser and go to the address http://zabbix_server_name or https://zabbix_server_name if you set up Let’s Encrypt. On the first screen, you will see a welcome message. Click Next step to continue.

Web界面使您可以查看报告并添加要监视的主机，但是在使用之前需要进行一些初始设置。启动浏览器，如果设置了“加密”，则转到地址http:// zabbix_server_name或https:// zabbix_server_name 。在第一个屏幕上，您将看到一条欢迎消息。单击下一步继续。

On the next screen, you will see the table that lists all of the prerequisites to run Zabbix.

在下一个屏幕上，您将看到该表，其中列出了运行Zabbix的所有先决条件。

All of the values in this table must be OK, so verify that they are. Be sure to scroll down and look at all of the prerequisites. Once you’ve verified that everything is ready to go, click Next step to proceed.

该表中的所有值都必须为OK ，因此请验证它们是否正确。确保向下滚动并查看所有先决条件。确认一切准备就绪后，请单击下一步继续。

The next screen asks for database connection information.

下一个屏幕询问数据库连接信息。

You told the Zabbix server about your database, but the Zabbix web interface also needs access to the database to manage hosts and read data. Therefore enter the MySQL credentials you configured in Step 2. Click Next step to proceed.

您向Zabbix服务器介绍了数据库，但是Zabbix Web界面还需要访问数据库以管理主机和读取数据。因此，输入在步骤2中配置MySQL凭据。单击“下一步”继续。

On the next screen, you can leave the options at their default values.

在下一个屏幕上，您可以将选项保留为默认值。

The Name is optional; it is used in the web interface to distinguish one server from another in case you have several monitoring servers. Click Next step to proceed.

名称是可选的；如果您有多台监视服务器，则在Web界面中使用它将一台服务器与另一台服务器区分开。单击下一步继续。

The next screen will show the pre-installation summary so you can confirm everything is correct.

下一个屏幕将显示安装前摘要，因此您可以确认所有内容正确。

Click Next step to proceed to the final screen.

单击下一步进入最终屏幕。

The web interface setup is now complete. This process creates the configuration file /usr/share/zabbix/conf/zabbix.conf.php, which you could back up and use in the future. Click Finish to proceed to the login screen. The default user is Admin and the password is zabbix.

Web界面设置现已完成。此过程将创建配置文件/usr/share/zabbix/conf/zabbix.conf.php ，您将来可以备份和使用它。单击完成进入登录屏幕。默认用户为Admin ，密码为zabbix 。

Before you log in, set up the Zabbix agent on your second Ubuntu server.

登录之前，请在第二台Ubuntu服务器上设置Zabbix代理。

步骤6 —安装和配置Zabbix代理 (Step 6 — Installing and Configuring the Zabbix Agent)

Now you need to configure the agent software that will send monitoring data to the Zabbix server.

现在，您需要配置代理软件，该代理软件会将监视数据发送到Zabbix服务器。

登录第二台Ubuntu服务器：

ssh sammy@second_ubuntu_server_ip_address
ssh sammy @ second_ubuntu_server_ip_address

Just like on the Zabbix server, run the following commands to install the repository configuration package:

就像在Zabbix服务器上一样，运行以下命令来安装存储库配置包：

wget https://repo.zabbix.com/zabbix/5.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_5.0-1+focal_all.deb
wget https://repo.zabbix.com/zabbix/5.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_ 5.0-1 + focal_all.deb
sudo dpkg -i zabbix-release_5.0-1+focal_all.deb
须藤dpkg -i zabbix -release_ 5.0-1 + focal_all.deb

Next, update the package index:

接下来，更新包索引：

sudo apt update
sudo apt更新

Then install the Zabbix agent:

然后安装Zabbix代理：

sudo apt install zabbix-agent
sudo apt安装zabbix-agent

While Zabbix supports certificate-based encryption, setting up a certificate authority is beyond the scope of this tutorial. But you can use pre-shared keys (PSK) to secure the connection between the server and agent.

尽管Zabbix支持基于证书的加密，但是设置证书颁发机构不在本教程的范围之内。但是您可以使用预共享密钥(PSK)来保护服务器和代理之间的连接。

First, generate a PSK:

首先，生成一个PSK：

sudo sh -c "openssl rand -hex 32 > /etc/zabbix/zabbix_agentd.psk"
sudo sh -c“ openssl rand -hex 32> /etc/zabbix/zabbix_agentd.psk”

Show the key by using cat so you can copy it somewhere:

使用cat显示密钥，以便将其复制到某处：

cat /etc/zabbix/zabbix_agentd.psk
猫/etc/zabbix/zabbix_agentd.psk

The key will look something like this:

密钥将如下所示：


   
   
     
     
     
     
      
      
      
      
    
    Output
   
   
     
     
     
     75ad6cb5e17d244ac8c00c96a1b074d0550b8e7b15d0ab3cde60cd79af280fca

Save this for later; you will need it to configure the host.

保存下来供以后使用；您将需要它来配置主机。

Now edit the Zabbix agent settings to set up its secure connection to the Zabbix server. Open the agent configuration file in your text editor:

现在，编辑Zabbix代理设置以设置其与Zabbix服务器的安全连接。在文本编辑器中打开代理配置文件：

sudo nano /etc/zabbix/zabbix_agentd.conf
须藤纳米/etc/zabbix/zabbix_agentd.conf

Each setting within this file is documented via informative comments throughout the file, but you only need to edit some of them.

该文件中的每个设置都会通过整个文件中的信息性注释进行记录，但是您只需要对其进行一些编辑即可。

First you have to edit the IP address of the Zabbix server. Find the following section:

首先，您必须编辑Zabbix服务器的IP地址。查找以下部分：