ansible-collections / community.zabbix

Zabbix Ansible modules
http://galaxy.ansible.com/community/zabbix
Other
322 stars 284 forks source link

Running playbook to install and configure zabbix agent causes system corruption #1365

Closed j007bond007 closed 2 months ago

j007bond007 commented 2 months ago
SUMMARY

Deploying Zabbix agent (1) on Debian 12 machine causes system/user corruption, where the user can no longer login (error displayed on console is "Unable to cd to '/home/josh" and permissions on the home directory seem ok. My wiki software also breaks and displays "Internal Server Error". Odd warning was presented during playbook run:

10:47:52 AM TASK [community.zabbix.zabbix_agent : Create include dirs zabbix-agent] ******** 10:47:53 AM [WARNING]: Module invocation had junk after the JSON data: /bin/sh: 1: sleep: 10:47:53 AM Permission denied 10:47:54 AM fatal: [home1wikijs]: FAILED! => {"msg": "Failed to connect to the host via ssh: josh@home1wikijs: Permission denied (publickey,password)."}

ISSUE TYPE
COMPONENT NAME

community.zabbix.zabbix_agent

ANSIBLE VERSION
ansible [core 2.17.2]
  config file = /home/josh/Ansible/ansible.cfg
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /root/.local/pipx/venvs/ansible/lib/python3.11/site-packages/ansible
  ansible collection location = /home/josh/Ansible/collections:/root/.ansible/collections
  executable location = /root/.local/bin/ansible
  python version = 3.11.2 (main, May  2 2024, 11:59:08) [GCC 12.2.0] (/root/.local/pipx/venvs/ansible/bin/python)
  jinja version = 3.1.4
  libyaml = True
CONFIGURATION
COLLECTIONS_PATHS(/home/josh/Ansible/ansible.cfg) = ['/home/josh/Ansible/collections', '/root/.ansible/collections']
CONFIG_FILE() = /home/josh/Ansible/ansible.cfg
DEFAULT_HOST_LIST(/home/josh/Ansible/ansible.cfg) = ['/home/josh/Ansible/inventory/hosts']
DEFAULT_ROLES_PATH(/home/josh/Ansible/ansible.cfg) = ['/home/josh/Ansible/roles', '/root/.ansible/roles']
OS / ENVIRONMENT / Zabbix Version

I'm using Semaphore as a GUI, and it's running on the same machine as Ansible which are in an LXC running on a Proxmox VE host. Target OS is Debian 12 and it's also running on the same Proxmox VE node as an LXC.

STEPS TO REPRODUCE

Run playbook below towards a fairly stock Debian 12 machine (the debian 12 machine was updated from 11, not sure if that matters and is running WikiJS software on it for a wiki). Notice errors in the log and then try logging in via SSH or console to the user account that ansible uses.

- name: Install and configure Zabbix Agent
  hosts: home1wikijs
  become: yes

  roles:
    - role: community.zabbix.zabbix_agent
      zabbix_agent2: false
      zabbix_api_server_host: "10.0.0.55"
      zabbix_agent_package_state: "present"
      zabbix_agent_tlsconnect: "psk"
      zabbix_agent_tlsaccept: "psk"
      zabbix_agent_tlspskfile: "/home/josh/Ansible/psks/zabbix.psk"
      zabbix_agent_tlspskidentity: "PSK 001"
      zabbix_host_groups:
             - Linux Servers
      zabbix_agent_link_templates:
                  - Template OS Linux
EXPECTED RESULTS

I would expect Zabbix to be installed with no errors and my user account/system not corrupted.

ACTUAL RESULTS

I had to restore the LXC from backup twice as it this re-occured both times I ran it on the machine.

These are the logs of the playbook run:
10:47:00 AM
Task 52 added to queue
10:47:00 AM
Started: 52
10:47:00 AM
Run TaskRunner with template: Install Zabbix Agent
10:47:00 AM
Preparing: 52
10:47:00 AM
installing static inventory
10:47:00 AM
collection/requirements.yml has no changes. Skip galaxy install process.
10:47:00 AM
collection/requirements.yml has no changes. Skip galaxy install process.
10:47:00 AM
No role/requirements.yml file found. Skip galaxy install process.
10:47:00 AM
No role/requirements.yml file found. Skip galaxy install process.
10:47:01 AM
10:47:01 AM
PLAY [Install and configure Zabbix Agent 2] ************************************
10:47:01 AM
10:47:01 AM
TASK [Gathering Facts] *********************************************************
10:47:04 AM
ok: [home1wikijs]
10:47:04 AM
10:47:04 AM
TASK [community.zabbix.zabbix_agent : Include OS-specific variables] ***********
10:47:04 AM
ok: [home1wikijs]
10:47:04 AM
10:47:04 AM
TASK [community.zabbix.zabbix_agent : Determine Latest Supported Zabbix Version] ***
10:47:04 AM
ok: [home1wikijs]
10:47:04 AM
10:47:04 AM
TASK [community.zabbix.zabbix_agent : Check that version is supported] *********
10:47:04 AM
ok: [home1wikijs] => {
10:47:04 AM
    "changed": false,
10:47:04 AM
    "msg": "All assertions passed"
10:47:04 AM
}
10:47:04 AM
10:47:04 AM
TASK [community.zabbix.zabbix_agent : Load Appropriate Defaults] ***************
10:47:04 AM
ok: [home1wikijs]
10:47:04 AM
10:47:04 AM
TASK [community.zabbix.zabbix_agent : Set Variables] ***************************
10:47:05 AM
ok: [home1wikijs]
10:47:05 AM
10:47:05 AM
TASK [community.zabbix.zabbix_agent : Setting Zabbix API Server Port] **********
10:47:05 AM
ok: [home1wikijs]
10:47:05 AM
10:47:05 AM
TASK [Install Repository] ******************************************************
10:47:05 AM
10:47:05 AM
TASK [community.zabbix.zabbix_repo : Include OS-specific variables] ************
10:47:05 AM
ok: [home1wikijs]
10:47:05 AM
10:47:05 AM
TASK [community.zabbix.zabbix_repo : Install the correct repository] ***********
10:47:05 AM
included: /home/josh/Ansible/collections/ansible_collections/community/zabbix/roles/zabbix_repo/tasks/Debian.yml for home1wikijs
10:47:05 AM
10:47:05 AM
TASK [community.zabbix.zabbix_repo : Debian | Installing gnupg] ****************
10:47:07 AM
ok: [home1wikijs]
10:47:07 AM
10:47:07 AM
TASK [community.zabbix.zabbix_repo : Debian | Create /etc/apt/keyrings/ on older versions] ***
10:47:08 AM
skipping: [home1wikijs]
10:47:08 AM
10:47:08 AM
TASK [community.zabbix.zabbix_repo : Debian | Download gpg key] ****************
10:47:10 AM
changed: [home1wikijs]
10:47:10 AM
10:47:10 AM
TASK [community.zabbix.zabbix_repo : Debian | Installing repository Debian] ****
10:47:14 AM
changed: [home1wikijs]
10:47:14 AM
10:47:14 AM
TASK [community.zabbix.zabbix_repo : Debian | Create /etc/apt/preferences.d/] ***
10:47:14 AM
skipping: [home1wikijs]
10:47:14 AM
10:47:14 AM
TASK [community.zabbix.zabbix_repo : Debian | Configuring the weight for APT] ***
10:47:14 AM
skipping: [home1wikijs]
10:47:14 AM
10:47:14 AM
TASK [community.zabbix.zabbix_repo : Debian | Update apt cache if repo was added] ***
10:47:19 AM
changed: [home1wikijs]
10:47:19 AM
10:47:19 AM
TASK [community.zabbix.zabbix_agent : Install the correct repository] **********
10:47:19 AM
included: /home/josh/Ansible/collections/ansible_collections/community/zabbix/roles/zabbix_agent/tasks/Debian.yml for home1wikijs
10:47:19 AM
10:47:19 AM
TASK [community.zabbix.zabbix_agent : Debian | Installing zabbix-agent] ********
10:47:26 AM
changed: [home1wikijs]
10:47:26 AM
10:47:26 AM
TASK [community.zabbix.zabbix_agent : Debian | Installing zabbix-{sender,get}] ***
10:47:34 AM
changed: [home1wikijs]
10:47:34 AM
10:47:34 AM
TASK [community.zabbix.zabbix_agent : Debian | Enable the service] *************
10:47:36 AM
ok: [home1wikijs]
10:47:36 AM
10:47:36 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Default tlsconnect to enforce PSK] ***
10:47:36 AM
skipping: [home1wikijs]
10:47:36 AM
10:47:36 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Default tlsaccept to enforce PSK when zabbix_agent_tlsaccept is not defined] ***
10:47:36 AM
skipping: [home1wikijs]
10:47:36 AM
10:47:36 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Default tlsaccept to enforce PSK when zabbix_agent_tlsaccept is defined] ***
10:47:36 AM
skipping: [home1wikijs]
10:47:36 AM
10:47:36 AM
TASK [community.zabbix.zabbix_agent : Gather PSK Secret Info] ******************
10:47:36 AM
included: /home/josh/Ansible/collections/ansible_collections/community/zabbix/roles/zabbix_agent/tasks/psk_secret.yml for home1wikijs
10:47:36 AM
10:47:36 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Set Path Variables for Windows] ***
10:47:36 AM
skipping: [home1wikijs]
10:47:36 AM
10:47:36 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Check for existing TLS PSK file | Windows] ***
10:47:36 AM
skipping: [home1wikijs]
10:47:36 AM
10:47:36 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Check for existing TLS PSK file | Linux] ***
10:47:38 AM
ok: [home1wikijs]
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : Set zabbix_agent_tlspskcheck] ************
10:47:38 AM
ok: [home1wikijs]
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | read existing TLS PSK file] ****
10:47:38 AM
skipping: [home1wikijs]
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Save Existing PSK Secret] ******
10:47:38 AM
skipping: [home1wikijs]
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Use Existing PSK Secret] *******
10:47:38 AM
skipping: [home1wikijs]
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Generate New PSK Secret] *******
10:47:38 AM
skipping: [home1wikijs]
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : Create Directory for PSK File | Windows] ***
10:47:38 AM
skipping: [home1wikijs]
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Template PSK Secret | Windows] ***
10:47:38 AM
skipping: [home1wikijs]
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : Create Directory for PSK File | Linux] ***
10:47:38 AM
skipping: [home1wikijs]
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Template PSK Secret | Linux] ***
10:47:38 AM
skipping: [home1wikijs]
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : Gather PSK Identity Info] ****************
10:47:38 AM
included: /home/josh/Ansible/collections/ansible_collections/community/zabbix/roles/zabbix_agent/tasks/psk_identity.yml for home1wikijs
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Check for existing TLS PSK identity | Windows] ***
10:47:38 AM
skipping: [home1wikijs]
10:47:38 AM
10:47:38 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Check for existing TLS PSK identity | Linux] ***
10:47:40 AM
ok: [home1wikijs]
10:47:40 AM
10:47:40 AM
TASK [community.zabbix.zabbix_agent : Set zabbix_agent_tlspskidentity_check] ***
10:47:40 AM
ok: [home1wikijs]
10:47:40 AM
10:47:40 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Read existing TLS PSK identity file] ***
10:47:40 AM
skipping: [home1wikijs]
10:47:40 AM
10:47:40 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Use existing TLS PSK identity] ***
10:47:40 AM
skipping: [home1wikijs]
10:47:40 AM
10:47:40 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Generate new TLS PSK identity] ***
10:47:40 AM
skipping: [home1wikijs]
10:47:40 AM
10:47:40 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Template PSK Identity | Windows] ***
10:47:40 AM
skipping: [home1wikijs]
10:47:40 AM
10:47:40 AM
TASK [community.zabbix.zabbix_agent : AutoPSK | Template PSK Identity | Linux] ***
10:47:44 AM
changed: [home1wikijs]
10:47:44 AM
10:47:44 AM
TASK [community.zabbix.zabbix_agent : Configure Agent] *************************
10:47:44 AM
skipping: [home1wikijs]
10:47:44 AM
10:47:44 AM
TASK [community.zabbix.zabbix_agent : Configure Agent] *************************
10:47:44 AM
included: /home/josh/Ansible/collections/ansible_collections/community/zabbix/roles/zabbix_agent/tasks/Linux.yml for home1wikijs
10:47:44 AM
10:47:44 AM
TASK [community.zabbix.zabbix_agent : Set default ip address for zabbix_agent_ip] ***
10:47:44 AM
ok: [home1wikijs]
10:47:44 AM
10:47:44 AM
TASK [community.zabbix.zabbix_agent : Get Total Private IP Addresses] **********
10:47:44 AM
[WARNING]: Collection ansible.utils does not support Ansible version 2.14.3
10:47:44 AM
ok: [home1wikijs]
10:47:44 AM
10:47:44 AM
TASK [community.zabbix.zabbix_agent : Set first public ip address for zabbix_agent_ip] ***
10:47:44 AM
skipping: [home1wikijs]
10:47:44 AM
10:47:44 AM
TASK [community.zabbix.zabbix_agent : Set first private ip address for zabbix_agent_ip] ***
10:47:44 AM
skipping: [home1wikijs]
10:47:44 AM
10:47:44 AM
TASK [community.zabbix.zabbix_agent : Fail invalid specified agent_listeninterface] ***
10:47:44 AM
skipping: [home1wikijs]
10:47:44 AM
10:47:44 AM
TASK [community.zabbix.zabbix_agent : Set network interface] *******************
10:47:44 AM
skipping: [home1wikijs]
10:47:44 AM
10:47:44 AM
TASK [community.zabbix.zabbix_agent : Get IP of agent_listeninterface when no agent_listenip specified] ***
10:47:44 AM
skipping: [home1wikijs]
10:47:44 AM
10:47:44 AM
TASK [community.zabbix.zabbix_agent : Default agent_listenip to all when not specified] ***
10:47:44 AM
skipping: [home1wikijs]
10:47:44 AM
10:47:44 AM
TASK [community.zabbix.zabbix_agent : Fail invalid specified agent_listenip] ***
10:47:45 AM
skipping: [home1wikijs]
10:47:45 AM
10:47:45 AM
TASK [community.zabbix.zabbix_agent : Configure SELinux when enabled] **********
10:47:45 AM
skipping: [home1wikijs]
10:47:45 AM
10:47:45 AM
TASK [community.zabbix.zabbix_agent : Adding zabbix group] *********************
10:47:45 AM
skipping: [home1wikijs]
10:47:45 AM
10:47:45 AM
TASK [community.zabbix.zabbix_agent : Adding zabbix user] **********************
10:47:45 AM
skipping: [home1wikijs]
10:47:45 AM
10:47:45 AM
TASK [community.zabbix.zabbix_agent : Configure zabbix-agent] ******************
10:47:49 AM
changed: [home1wikijs]
10:47:49 AM
10:47:49 AM
TASK [community.zabbix.zabbix_agent : Create include dir zabbix-agent] *********
10:47:52 AM
changed: [home1wikijs]
10:47:52 AM
10:47:52 AM
TASK [community.zabbix.zabbix_agent : Create include dirs zabbix-agent] ********
10:47:53 AM
[WARNING]: Module invocation had junk after the JSON data: /bin/sh: 1: sleep:
10:47:53 AM
Permission denied
10:47:54 AM
fatal: [home1wikijs]: FAILED! => {"msg": "Failed to connect to the host via ssh: josh@home1wikijs: Permission denied (publickey,password)."}
10:47:54 AM
10:47:54 AM
PLAY RECAP *********************************************************************
10:47:54 AM
home1wikijs                : ok=29   changed=8    unreachable=0    failed=1    skipped=32   rescued=0    ignored=0   
10:47:54 AM
10:47:54 AM
Running app failed: exit status 2
pyrodie18 commented 2 months ago

Would ask you to rerun and increase verbosity using -vvv

j007bond007 commented 2 months ago

Attached is the verbose log (It only gave me the option for -vvvv in Semaphore) Zabbix deployment breaking system-August8th2024.log

pyrodie18 commented 2 months ago

I'm inclined to agree with @alexPykavy had their comment in #1366 based on this output that gets garbled up in the end:

{
  "path": "/",
  "changed": true,
  "diff": {
    "before": {
      "path": "/",
      "group": 0,
      "mode": "0755"
    },
    "after": {
      "path": "/",
      "group": 117,
      "mode": "0750"
    }
  },
  "uid": 0,
  "gid": 117,
  "owner": "root",
  "group": "zabbix",
  "mode": "0750",
  "state": "directory",
  "size": 4096,
  "invocation": {
    "module_args": {
      "path": "/",
      "owner": "root",
      "group": "zabbix",
      "mode": "0750",
      "state": "directory",
      "recurse": false,
      "force": false,
      "follow": true,
      "modification_time_format": "%Y%m%d%H%M.%S",
      "access_time_format": "%Y%m%d%H%M.%S",
      "unsafe_writes": false,
      "_original_basename": null,
      "_diff_peek": null,
      "src": null,
      "modification_time": null,
      "access_time": null,
      "seuser": null,
      "serole": null,
      "selevel": null,
      "setype": null,
      "attributes": null
    }
  }
}

What I don't understand though is why it's doing that because your vars at the top don't show you changing the zabbix_agent_include_dir var.

pyrodie18 commented 2 months ago

OK try updating to 3.1.1 release and run it again. Let us know what happens. Will leave this open for a few days.

j007bond007 commented 2 months ago

OK try updating to 3.1.1 release and run it again. Let us know what happens. Will leave this open for a few days.

Updated to 3.1.1 - and that seems to have fixed the corruption issue! Wikijs and the system/user login still work after running the playbook. All good! (Edited.... I had made a silly mistake in my playbook)

Great job!