7ZX ENCRYPTION FULL

Older versions of the OpenSSL library (1.0.1, 1.0.2c) also support PSKs, but available PSK ciphersuites do not provide Perfect Forward Secrecy. GnuTLS and OpenSSL 1.1.0 libraries support PSK ciphersuites with Perfect Forward Secrecy. If you plan to use pre-shared keys (PSK), consider using GnuTLS or OpenSSL 1.1.0 (or newer) libraries in Zabbix components using PSKs.

-with-openssl (also used for LibreSSL)ДЇor example, to configure the sources for server and agent with OpenSSL you may use something like:.

The library is selected by specifying the respective option to 'configure' script: Zabbix components compiled with LibreSSL will not be able to use PSK, only certificates can be used.

LibreSSL is supported as a compatible replacement of OpenSSL the new tls_*() LibreSSL-specific API functions are not used.

LibreSSL - tested with versions 2.7.4, 2.8.2:.

Note that 3.0.x is supported since Zabbix 6.0.4. To support encryption Zabbix must be compiled and linked with one of the supported crypto libraries: Zabbix agent checks performed by network discovery will be unencrypted and if Zabbix agent is configured to reject unencrypted connections such checks will not succeed.

Encryption is not supported by network discovery.

Timeouts may need to be increased, otherwise some items and actions running remote scripts on agents may work with unencrypted connections, but fail with timeout with encrypted.

With encryption about 1000 ms are added for establishing the TLS connection

For example, if packet delay is 100ms then opening a TCP connection and sending unencrypted request takes around 200ms.Adding encryption increases the time for item checks and actions, depending on network latency:.

7ZX ENCRYPTION FULL

Currently each encrypted connection opens with a full TLS handshake, no session caching and tickets are implemented.

Between Zabbix frontend and Zabbix server.

Between the web server running Zabbix frontend and user web browser.

Built-in encryption does not protect communications:.

Pre-shared keys are entered in Zabbix frontend and stored in Zabbix database in plain text.

Private keys are stored in plain text in files readable by Zabbix components during startup.

Adding an encryption does not require opening new ports on firewalls. Zabbix daemon programs use one listening port for encrypted and unencrypted incoming connections.

Server (proxy) can use different encryption configurations for different hosts.

Some proxies and agents can be configured to use certificate-based encryption with the server, while others can use pre-shared key-based encryption, and yet others continue with unencrypted communications (as before).

To Zabbix database from Zabbix frontend and server/proxyД®ncryption is optional and configurable for individual components:.

Between Zabbix server, Zabbix proxy, Zabbix agent, zabbix_sender and zabbix_get utilities.

Certificate-based and pre-shared key-based encryption is supported.Д®ncryption can be configured for connections: Zabbix supports encrypted communications between Zabbix components using Transport Layer Security (TLS) protocol v.1.2 and 1.3 (depending on the crypto library).

Testing cipher strings and allowing only PFS ciphersuites.

zabbix_get and zabbix_sender with encryption.

Compiling Zabbix with encryption support.

7zx encryption