zabbix >= 7.4.1-2 may require manual intervention

Starting with 7.4.1-2, the following Zabbix system user accounts (previously shipped by their related packages) will no longer be used. Instead, all Zabbix components will now rely on a shared zabbix user account (as originally intended by upstream and done by other distributions):

  • zabbix-server
  • zabbix-proxy
  • zabbix-agent (also used by the zabbix-agent2 package)
  • zabbix-web-service

This shared zabbix user account is provided by the newly introduced zabbix-common split package, which is now a dependency for all relevant zabbix-* packages.

The switch to the new user account is handled automatically for the corresponding main configuration files and systemd service units.

However, manual intervention may be required if you created custom files or configurations referencing to and / or being owned by the above deprecated users accounts, for example:

  • PSK files used for encrypted communication
  • Custom scripts for metrics collections or report generations
  • sudoers rules for metrics requiring elevated privileges to be collected
  • ...

Those should therefore be updated to refer to and / or be owned by the new zabbix user account, otherwise some services or user parameters may fail to work properly, or not at all.

Once migrated, you may remove the obsolete user accounts from your system.

[$] Debian grapples with offensive packages, again

A pair of packages containing fortune "cookies" that were deemed offensive have been removed from the upcoming Debian 13 ("trixie") release. This has, of course, led to a lengthy discussion and debate about what does, or does not, belong in the distribution. It may also lead to a general resolution (GR) to decide whether Debian's code of conduct (CoC) applies to the contents of packages.

Security updates for Monday

Security updates have been issued by AlmaLinux (java-21-openjdk, kernel, libxml2, and lz4), Debian (exempi, ruby-graphql, and sope), Fedora (binutils, chromium, gdk-pixbuf2, libsoup3, poppler, and reposurgeon), Mageia (glib2.0 and wxgtk), Oracle (jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base and libxml2), Red Hat (kernel, pandoc, pcs, qemu-kvm, redis, and rsync), SUSE (chromedriver, coreutils, cosign, docker, gdk-pixbuf-devel, glib2, gnutls, grub2, gstreamer-plugins-base, helm, ignition, java-21-openjdk, jbigkit, jq, kernel, kubernetes1.28, kwctl, libxml2, nvidia-open-driver-G06-signed, opensc, pam-config, protobuf, python310, tgt, and valkey), and Ubuntu (linux-iot).