This is a translation of the original English documentation page. Help us make it better.

Sidebar

Zabbix Summit 2022
Register for Zabbix Summit 2022

4 Sécuriser la connexion à la base de données

Aperçu

Cette section fournit les étapes de configuration de Zabbix et des exemples de configuration pour les connexions TLS sécurisées entre :

Base de données Composants Zabbix
MySQL Interface Zabbix, serveur Zabbix, proxy Zabbix
PostgreSQL Interface Zabbix, serveur Zabbix, proxy Zabbix

Pour configurer le chiffrement de connexion dans le SGBD, consultez la documentation officielle du fournisseur pour plus de détails :

  • MySQL : serveurs de base de données de réplication source et réplica.
  • MySQL : réplication de groupe, etc. serveurs de bases de données.
  • Options de chiffrement PostgreSQL.

Tous les exemples sont basés sur les versions GA de MySQL CE (8.0) et PgSQL (13) disponibles via les référentiels officiels utilisant CentOS 8.

Spécifications

Les éléments suivants sont requis pour configurer le chiffrement :

  • Le système d'exploitation pris en charge par les développeurs avec OpenSSL >=1.1.X ou alternative.

Il est recommandé d'éviter les systèmes d'exploitation en fin de vie, en particulier dans le cas de nouvelles installations

  • Le moteur de base de données (RDBMS) installé et maintenu à partir du référentiel officiel fourni par le développeur. Les systèmes d'exploitation sont souvent livrés avec des versions de logiciels de base de données obsolètes pour lesquelles la prise en charge du chiffrement n'est pas mise en œuvre, par exemple les systèmes basés sur RHEL 7 et PostgreSQL 9.2, MariaDB 5.5 sans prise en charge du chiffrement.
Terminologie

La définition de cette option force l'utilisation de la connexion TLS à la base de données à partir du serveur/proxy Zabbix et de l'interface à la base de données :

  • requis - se connecter en utilisant TLS comme mode de transport sans contrôle d'identité ;
  • verify_ca - se connecte à l'aide de TLS et vérifie le certificat ;
  • verify_full - se connecte à l'aide de TLS, vérifie le certificat et vérifie que l'identité de la base de données (CN) spécifiée par DBHost correspond à son certificat ;

Configuration de Zabbix

Frontend to the database

A secure connection to the database can be configured during frontend installation:

  • Mark the Database TLS encryption checkbox in the Configure DB connection step to enable transport encryption.
  • Mark the Verify database certificate checkbox that appears when TLS encryption field is checked to enable encryption with certificates.

For MySQL, the Database TLS encryption checkbox is disabled, if Database host is set to localhost, because connection that uses a socket file (on Unix) or shared memory (on Windows) cannot be encrypted.
For PostgreSQL, the TLS encryption checkbox is disabled, if the value of the Database host field begins with a slash or the field is empty.

The following parameters become available in the TLS encryption in certificates mode (if both checkboxes are marked):

Parameter Description
Database TLS CA file Specify the full path to a valid TLS certificate authority (CA) file.
Database TLS key file Specify the full path to a valid TLS key file.
Database TLS certificate file Specify the full path to a valid TLS certificate file.
Database host verification Mark this checkbox to activate host verification.
Disabled for MYSQL, because PHP MySQL library does not allow to skip the peer certificate validation step.
Database TLS cipher list Specify a custom list of valid ciphers. The format of the cipher list must conform to the OpenSSL standard.
Available for MySQL only.

TLS parameters must point to valid files. If they point to non-existent or invalid files, it will lead to the authorization error.
If certificate files are writable, the frontend generates a warning in the System information report that "TLS certificate files must be read-only." (displayed only if the PHP user is the owner of the certificate).

Certificates protected by passwords are not supported.

Use cases

Zabbix frontend uses GUI interface to define possible options: required, verify_ca, verify_full. Specify required options in the installation wizard step Configure DB connections. These options are mapped to the configuration file (zabbix.conf.php) in the following manner:

GUI settings Configuration file Description Result
...
// Used for TLS connection.
$DB['ENCRYPTION'] = true;
$DB['KEY_FILE'] = '';
$DB['CERT_FILE'] = '';
$DB['CA_FILE'] = '';
$DB['VERIFY_HOST'] = false;
$DB['CIPHER_LIST'] = '';
...
Check Database TLS encryption
Leave Verify database certificate unchecked
Enable 'required' mode.
...
$DB['ENCRYPTION'] = true;\\ $DB['KEY_FILE'] = '';
$DB['CERT_FILE'] = '';
$DB['CA_FILE'] = '/etc/ssl/mysql/ca.pem';
$DB['VERIFY_HOST'] = false;
$DB['CIPHER_LIST'] = '';
...
1. Check Database TLS encryption and Verify database certificate
2. Specify path to Database TLS CA file
Enable 'verify_ca' mode.
...
// Used for TLS connection with strictly defined Cipher list.
$DB['ENCRYPTION'] = true;
$DB['KEY_FILE'] = '<key_file_path>';
$DB['CERT_FILE'] = '<key_file_path>';
$DB['CA_FILE'] = '<key_file_path>';
$DB['VERIFY_HOST'] = true;
$DB['CIPHER_LIST'] = '<cipher_list>';
...

Or:

...
// Used for TLS connection without Cipher list defined - selected by MySQL server
$DB['ENCRYPTION'] = true;
$DB['KEY_FILE'] = '<key_file_path>';
$DB['CERT_FILE'] = '<key_file_path>';
$DB['CA_FILE'] = '<key_file_path>';
$DB['VERIFY_HOST'] = true;
$DB['CIPHER_LIST'] = '';
...
1. Check Database TLS encryption and Verify database certificate
2. Specify path to Database TLS key file
3. Specify path to Database TLS CA file
4. Specify path to Database TLS certificate file
6. Specify TLS cipher list (optional)
Enable 'verify_full' mode for MySQL.
...
$DB['ENCRYPTION'] = true;
$DB['KEY_FILE'] = '<key_file_path>';
$DB['CERT_FILE'] = '<key_file_path>';
$DB['CA_FILE'] = '<key_file_path>';
$DB['VERIFY_HOST'] = true;
$DB['CIPHER_LIST'] = ' ';
...
1. Check Database TLS encryption and Verify database certificate
2. Specify path to Database TLS key file
3. Specify path to Database TLS CA file
4. Specify path to Database TLS certificate file
6. Check Database host verification
Enable 'verify_full' mode for PostgreSQL.

See also: Encryption configuration examples for MySQL, Encryption configuration examples for PostgreSQL.

Zabbix server/proxy configuration

Secure connections to the database can be configured with the respective parameters in the Zabbix server and/or proxy configuration file.

Configuration Result
None Connection to the database without encryption.
1. Set DBTLSConnect=required Server/proxy make a TLS connection to the database. An unencrypted connection is not allowed.
1. Set DBTLSConnect=verify_ca
2. Set DBTLSCAFile - specify the TLS certificate authority file
Server/proxy make a TLS connection to the database after verifying the database certificate.
1. Set DBTLSConnect=verify_full
2. Set DBTLSCAFile - specify TLS certificate authority file
Server/proxy make a TLS connection to the database after verifying the database certificate and the database host identity.
1. Set DBTLSCAFile - specify TLS certificate authority file
2. Set DBTLSCertFile - specify the client public key certificate file
3. Set DBTLSKeyFile - specify the client private key file
Server/proxy provide a client certificate while connecting to the database.
1. Set DBTLSCipher - the list of encryption ciphers that the client permits for connections using TLS protocols up to TLS 1.2

or DBTLSCipher13 - the list of encryption ciphers that the client permits for connections using TLS 1.3 protocol
(MySQL) TLS connection is made using a cipher from the provided list.
(PostgreSQL) Setting this option will be considered as an error.