Modifying Web Server Configuration

To enable direct access to the Zabbix web interface via an IP address without the /zabbix suffix, you need to adjust the web server configuration.

1. Open the main Apache configuraton file:

sudo nano /etc/httpd/conf/httpd.conf

2. Locate the DocumentRoot directive. Comment out the existing line and add a new one pointing to the Zabbix web root directory. The path may vary depending on your Zabbix version.

# Comment out the default DocumentRoot
# DocumentRoot "/var/www/html"

# Set the new DocumentRoot to the Zabbix web files
DocumentRoot "/usr/share/zabbix"

# For newer Zabbix versions (e.g., 7.4), the path includes the 'ui' directory
# DocumentRoot "/usr/share/zabbix/ui"

3. Save the file and exit the editor. Then, restart the Apache and Zabbix server services to apply the changes.

sudo systemctl restart httpd
sudo systemctl restart zabbix-server

Troubleshooting Connection Failures

If you encounter a connection failure to the Zabbix server (e.g., "Connection to Zabbix server 'localhost:10051' failed"), it could be due to:

• Incorrect NodeAddress or ListenPort settings in zabbix_server.conf, or an overridden server IP/DNS in zabbix.conf.php.
• Incorrect DNS server configuration leading to failed address resolution.

If you haven't modified the default parameters, the issue is likely related to firewall or SELinux settings.

Firewall Configuration

Insure that the necessary ports are open in the system firewall.

# Allow HTTP traffic
sudo firewall-cmd --zone=public --add-service=http --permanent

# Allow Zabbix server communication on port 10051
sudo firewall-cmd --zone=public --add-port=10051/tcp --permanent

# Reload firewall rules to apply changes
sudo firewall-cmd --reload

Configuring SELinux for Zabbix Communication (Recommended)

SELinux might be blocking the connection. Follow these steps to configure it correctly.

Step 1: Verify SELinux Denials

First, check the SELinux audit logs to see if it is blocking the connection.

# Search for Zabbix-related SELinux denial entries
grep -i zabbix /var/log/audit/audit.log | grep -i denied

An output similar to type=AVC msg=audit(xxx): avc: denied { name_connect } for pid=xxx comm="zabbix_server" dest=10051 ... confirms a SELinux block.

Step 2: Allow Zabbix to Use Port 10051

There are two methods to resolve this. The first method is permanent and recommended.

Method 1: Permanent SELinux Policy Adjustment

Use the semanage command to add the port and set the required booleans.

# Install the semanage utility if it's not already installed
sudo dnf install -y policycoreutils-python-utils

# Permanently add port 10051 to the SELinux allowed ports for Zabbix
sudo semanage port -a -t zabbix_port_t -p tcp 10051

# Verify the port has been added successfully
sudo semanage port -l | grep zabbix_port_t
# Expected output: zabbix_port_t    tcp    10050, 10051

If the connection still fails, you may need to enable specific SELinux booleans.

# Analyze the specific denial to understand the required boolean
sudo grep -i zabbix /var/log/audit/audit.log | grep -i denied | audit2why

# Based on the analysis, enable the necessary booleans
sudo setsebool -P httpd_can_network_connect 1
sudo setsebool -P httpd_can_connect_zabbix 1

Method 2: Temporary Permissive Mode

For temporary testing, you can set SELinux to Permissive mode. This will not block actions but will still log them. This setting is not persistent and will be reset on reboot.

sudo setenforce 0