Collection of Scripts for Regular Tasks

Install a Zabbix proxy onto a Debian host to act as a remote proxy to talk to a central Zabbix server. Supports: Debian 11 (Bullseye), Debian 12 (Bookworm), Debian 13 (Trixie)

Fixed settings: Active mode, SQLite3 database, performance tuned for a small LAN (~12 agents). Prompts for: Zabbix version, proxy hostname, server address, and PSK encryption.

curl -fsSL https://raw.githubusercontent.com/MarkLFT/Scripts/main/install-zabbix-proxy.sh -o /tmp/install-zabbix-proxy.sh && sudo bash /tmp/install-zabbix-proxy.sh

Prompts for all settings including proxy mode, database type (SQLite3/MySQL/PostgreSQL), and performance tuning.

curl -fsSL https://raw.githubusercontent.com/MarkLFT/Scripts/main/install-zabbix-proxy-full.sh -o /tmp/install-zabbix-proxy-full.sh && sudo bash /tmp/install-zabbix-proxy-full.sh

Installs Zabbix Agent 2 on systems to be monitored. Configures it to connect to a local proxy. Designed to be run from within TacticalRMM — obtains values from site and global variables. Will auto-detect monitorable services (SQL Server, MySQL, PostgreSQL, Nginx, Apache, Docker, Redis, RabbitMQ) and configure the appropriate plugin. When SQL Server is detected the script installs the MSSQL loadable plugin, creates the zabbix SQL login with the required permissions (including msdb grants for SQL Agent job monitoring), and writes live credentials into the plugin config — no manual post-install steps required. When Redis is detected the script installs the Redis loadable plugin and writes the session config. When RabbitMQ is detected the script enables the management plugin and creates the zbx_monitor monitoring user (RabbitMQ uses HTTP-based monitoring via the Zabbix template, not an agent plugin). Sends a Discord notification on install or upgrade.

Via TacticalRMM with site variables:

curl -fsSL https://raw.githubusercontent.com/MarkLFT/Scripts/main/install-zabbix-agent-linux-tactical-rmm.sh | sudo bash -s -- "{{site.ZabbixProxy}}" "{{site.ZabbixServer}}" "{{global.DiscordWebhook}}" "{{global.ZabbixVersion}}" "{{global.ZabbixMSSQLPassword}}" "{{site.MSSQLSAPassword}}" "{{agent.ZabbixHostName}}"

Manual use with real values:

curl -fsSL https://raw.githubusercontent.com/MarkLFT/Scripts/main/install-zabbix-agent-linux-tactical-rmm.sh | sudo bash -s -- "10.10.1.5" "10.10.0.10" "https://discord.com/api/webhooks/..." "7.4" "ZabbixMSSQLPass!" "SAPassword!" "My SQL Server"

Force reconfigure (skips repo/install, rewrites all configs and recreates SQL logins):

curl -fsSL https://raw.githubusercontent.com/MarkLFT/Scripts/main/install-zabbix-agent-linux-tactical-rmm.sh | sudo bash -s -- "{{site.ZabbixProxy}}" "{{site.ZabbixServer}}" "{{global.DiscordWebhook}}" "{{global.ZabbixVersion}}" "{{global.ZabbixMSSQLPassword}}" "{{site.MSSQLSAPassword}}" "{{agent.ZabbixHostName}}" "force"

Via TacticalRMM (recommended):

& ([scriptblock]::Create((Invoke-RestMethod https://raw.githubusercontent.com/MarkLFT/Scripts/main/install-zabbix-agent-windows-tactical-rmm.ps1))) -ZabbixProxy "{{site.ZabbixProxy}}" -ZabbixServer "{{site.ZabbixServer}}" -DiscordWebhook "{{global.DiscordWebhook}}" -ZabbixVersion "{{global.ZabbixVersion}}" -ZabbixMSSQLPassword "{{global.ZabbixMSSQLPassword}}" -ZabbixHostName "{{agent.ZabbixHostName}}"

Manual use — download first then run:

Invoke-WebRequest https://raw.githubusercontent.com/MarkLFT/Scripts/main/install-zabbix-agent-windows-tactical-rmm.ps1 -OutFile "$env:TEMP\install-zabbix-agent-windows-tactical-rmm.ps1"
& "$env:TEMP\install-zabbix-agent-windows-tactical-rmm.ps1" -ZabbixProxy "10.10.1.5" -ZabbixServer "10.10.0.10" -DiscordWebhook "https://discord.com/api/webhooks/..." -ZabbixVersion "7.4.0" -ZabbixMSSQLPassword "ZabbixMSSQLPass!" -ZabbixHostName "My SQL Server"

Force reconfigure (skips MSI download/install, rewrites all configs and recreates SQL logins):

& ([scriptblock]::Create((Invoke-RestMethod https://raw.githubusercontent.com/MarkLFT/Scripts/main/install-zabbix-agent-windows-tactical-rmm.ps1))) -ZabbixProxy "{{site.ZabbixProxy}}" -ZabbixServer "{{site.ZabbixServer}}" -DiscordWebhook "{{global.DiscordWebhook}}" -ZabbixVersion "{{global.ZabbixVersion}}" -ZabbixMSSQLPassword "{{global.ZabbixMSSQLPassword}}" -ZabbixHostName "{{agent.ZabbixHostName}}" -Force

Sets up automatic network discovery of devices that either have the Zabbix agent installed or have SNMP configured. Connects to the Zabbix API, fetches proxies and host groups, and creates the discovery rule and auto-add actions.

Checks performed: Zabbix agent (port 10050), SNMPv2c (port 161), SNMPv1 (port 161) Prompts for: Zabbix server URL, API credentials, proxy, IP range, scan interval, SNMP community string, host groups. Templates are not assigned automatically — apply them manually after discovery.

curl -fsSL https://raw.githubusercontent.com/MarkLFT/Scripts/main/setup-zabbix-discovery.sh \
  -o /tmp/setup-zabbix-discovery.sh && bash /tmp/setup-zabbix-discovery.sh

The Zabbix Agent 2 MSSQL plugin monitors SQL Server instances via a dedicated SQL login. The agent install scripts handle everything automatically when the ZabbixMSSQLPassword variable is set (and MSSQLSAPassword on Linux):

1. Installs the zabbix-agent2-plugin-mssql loadable plugin package
2. Creates (or updates) the zabbix SQL login with the provided password
3. Grants server-level permissions: VIEW SERVER STATE, VIEW ANY DEFINITION
4. Grants msdb permissions for SQL Agent job monitoring (sysjobs, sysjobactivity, sysjobservers, agent_datetime)
5. Writes live credentials into the plugin config at plugins.d/mssql.conf
6. Disables all loadable plugins not needed for detected services (prevents crashes from e.g. NVIDIA plugin on a server without a GPU)
7. Adds the plugins.d/ Include directive to the main agent config

No manual post-install steps are required.

On Windows the script uses Windows Authentication (trusted connection as SYSTEM) to create the SQL login, so no SA password is needed. On Linux, the MSSQLSAPassword site variable is required to authenticate to SQL Server via sqlcmd.

Session credentials are written into the package-installed plugin config, not a separate file:

In the Zabbix frontend, assign the MSSQL by Zabbix agent 2 template to the host. This template provides out-of-the-box items, triggers, and dashboards for SQL Server monitoring.

Installs the TacticalRMM agent on a host and registers it with your TacticalRMM server. Connects to the TacticalRMM API to fetch available clients and sites so you can pick from a list — no need to look up IDs manually. Mesh URL and token are retrieved automatically from the API — no manual configuration of MeshCentral required.

Prompts for: TacticalRMM API URL, API key, client (list), site (list), agent type (Server/Workstation).

API Key: Generate in TacticalRMM under Settings → Global Settings → API Keys → Add API Key. The key is entered interactively and never stored in the script.

Installs both the MeshCentral agent (required for Take Control / Remote Background) and the TacticalRMM agent (monitoring, scripts, tasks, patch management).

The Linux agent is built from source using the community install script originally created by netvolt and maintained by Nerdy-Technician. This compiles the agent from the official amidaware/rmmagent source code using Go. Compilation takes a few minutes on first run — this is normal.

Note: This script targets the community (free) licence. The paid signed-agent installer from the TRMM UI is not required.

Auth Token (Linux only): In TacticalRMM go to Agents → Install Agent → select Windows → Manual installation → click Show Manual Instructions → copy the value after --auth. This token is used to register the agent and can be reused for multiple installs until it expires.

curl -fsSL https://raw.githubusercontent.com/MarkLFT/Scripts/main/install-tacticalrmm-agent-linux.sh \
  -o /tmp/install-tacticalrmm-agent-linux.sh && sudo bash /tmp/install-tacticalrmm-agent-linux.sh

After installation verify both services are running:

systemctl status tacticalagent
systemctl status meshagent

Uses the TacticalRMM deployment API to generate the installer automatically — no auth token needed.

Run as Administrator:

Invoke-WebRequest https://raw.githubusercontent.com/MarkLFT/Scripts/main/install-tacticalrmm-agent-windows.ps1 -OutFile "$env:TEMP\install-tacticalrmm-agent-windows.ps1"
& "$env:TEMP\install-tacticalrmm-agent-windows.ps1"

End-to-end provisioning script for a dedicated SQL Server 2025 instance on Ubuntu 24.04 LTS. Installs SQL Server, configures MSDTC, replaces UFW with iptables, sets up automated backups using Ola Hallengren's Maintenance Solution, and hardens the OS.

Run as root:

curl -fsSL https://raw.githubusercontent.com/MarkLFT/Scripts/main/install-sql-linux-with-backup.sh -o /tmp/install-sql-linux-with-backup.sh && sudo bash /tmp/install-sql-linux-with-backup.sh

All settings are collected before any changes are made. A summary is displayed for confirmation.

• All passwords and credentials are entered interactively and never stored in the script itself.
• SMB credentials are stored in root-only files (chmod 600) under /root/.
• TDE certificates are stored separately from backups — locally in /etc/mssql-tde-certs/ (root-only) and on a dedicated SMB share distinct from the backup share.
• The TDE certificate export password must be stored offline (password manager or physical safe) — without it, backups cannot be restored on another server.
• If the remote SMB share is unreachable, backups still complete locally — SMB mount failure is non-fatal.

Both scripts log to /var/log/mssql_backup.log and record all operations in the master.dbo.CommandLog table.

Cron jobs are defined in /etc/cron.d/mssql_backup.

# Run a manual full backup
sudo /usr/local/sbin/mssql_backup.sh

# Run a manual log backup
sudo /usr/local/sbin/mssql_logbackup.sh

# View backup log
sudo tail -50 /var/log/mssql_backup.log

# Check backup history in SQL Server
/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -C -Q "SELECT database_name, type, backup_start_date, backup_finish_date FROM msdb.dbo.backupset ORDER BY backup_start_date DESC;"

# Check Ola Hallengren's command log
/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -C -Q "SELECT DatabaseName, CommandType, StartTime, EndTime, ErrorNumber FROM master.dbo.CommandLog ORDER BY StartTime DESC;"

# Check backup files on disk
sudo find /sqlbackup -name "*.bak" -o -name "*.trn" | head -20

# Verify SMB share is mounted
mountpoint -q /mnt/sqlbackups_remote && echo "Mounted" || echo "Not mounted"

For servers already running SQL Server that were set up with UFW and need to switch to iptables. UFW can be unstable on servers with complex NAT rules (such as the MSDTC port 135 PREROUTING redirect), and iptables-persistent provides more predictable behaviour across reboots.

This script:

• Snapshots all current UFW rules and live iptables state to /root/firewall-migration-<timestamp>/ before making any changes
• Parses open UFW ports and preserves them in the new iptables ruleset (so no ports are accidentally lost)
• Builds a clean iptables ruleset with INPUT DROP policy, allowing SSH, SQL Server (1433), and MSDTC ports
• Reads MSDTC port configuration from /var/opt/mssql/mssql.conf automatically (defaults to 13500/51999)
• Adds NAT PREROUTING and OUTPUT rules to redirect port 135 to the MSDTC RPC port
• Persists all rules via iptables-persistent and enables netfilter-persistent on boot
• Removes UFW completely

curl -fsSL https://raw.githubusercontent.com/MarkLFT/Scripts/main/migrate-ufw-to-iptables.sh -o /tmp/migrate-ufw-to-iptables.sh && sudo bash /tmp/migrate-ufw-to-iptables.sh

To roll back if something goes wrong:

sudo iptables-restore < /root/firewall-migration-*/iptables-v4-before.rules

For servers already deployed, a hotfix script applies all fixes without rebuilding:

• Makes SMB mount failure non-fatal (local backup always proceeds)
• Fixes duplicate log lines from cron
• Adds transaction log backups every 15 minutes
• Runs both backups immediately

curl -sL https://raw.githubusercontent.com/MarkLFT/Scripts/main/fix-sql-backup-smb-fatal.sh | sudo bash

Safe to run multiple times — each patch is skipped if already applied.