Zabbix Server 5 with VMWare 5.1 monitoring implementation

[andvsilva]

Hi,

I'm new with zabbix implementation, in my environment I'm using VM Ware ESXi 5.1 and I can't update this. I'm trying to add this ESXi into Zabbix but I'm always receiving error 'SSL Connection Error'.

Someone know if Zabbix works with TLS 1.0 because my VMWare is old and accept connection with 1.0 I tried to connection using Curl and TLS 1.0 works well but If I put TLS 1.2 or TLS 1.3 doesn't work follow the commands and returns:

[root@localhost ~]# curl -k -v -k --insecure --tlsv1 -u [email protected] https://IPHOST/sdk
Enter host password for user '[email protected]':
..................
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CONNECT phase completed!
* CONNECT phase completed!
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.0 (IN), TLS handshake, Certificate (11):
* TLSv1.0 (IN), TLS handshake, Server finished (14):
* TLSv1.0 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.0 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.0 (OUT), TLS handshake, Finished (20):
* TLSv1.0 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.0 / AES256-SHA
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: C=US; ST=California; L=Palo Alto; O=VMware, Inc; OU=VMware ESX Server Default Certificate; [email protected]; CN=localhost.localdomain; unstructuredName=1387372133,564d7761726520496e632e
* start date: Dec 18 13:08:54 2013 GMT
* expire date: Jun 18 13:08:54 2025 GMT
* issuer: O=VMware Installer
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* Server auth using Basic with user '[email protected]'
> GET /sdk HTTP/1.1
> Host: 10.227.67.134
> Authorization: Basic cm9vdEB2c3BoZXJlLmxvY2FsOjZ5aEsyTm94T09TYjI=
> User-Agent: curl/7.61.1
> Accept: */*



[root@localhost ~]# curl -k -v -k --insecure --tlsv1.2 -u [email protected] https://IPHOST/sdk
Enter host password for user '[email protected]':
..................
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CONNECT phase completed!
* CONNECT phase completed!
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS alert, protocol version (582):
* error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol
* Closing connection 0
curl: (35) error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol

Can you help me with solve it? I trying understand if Zabbix accept TLS 1.0 and how to force use this TLS version because my old VMWare.

Thanks a lot.

[ToineToine]

Hi, I am also new to the Zabbix implementation. I would like to know if you would have found a solution since?
I have the same problem. I have tried several solutions to otherwise monitor my ESXi5.1:

- Do an Eternal check but I have a problem with the access rights that I cannot change (it is a security constraint)
-Use an SNMP agent but I have errors like "snmp_parse_oid (): cannot parse OID"


I had the opportunity to verify that an ESXI 5.5 does not pose any problem, would we really have to update the esxi5.1?

[andvsilva]

Hi, I am also new to the Zabbix implementation. I would like to know if you would have found a solution since?
I have the same problem. I have tried several solutions to otherwise monitor my ESXi5.1:

- Do an Eternal check but I have a problem with the access rights that I cannot change (it is a security constraint)
-Use an SNMP agent but I have errors like "snmp_parse_oid (): cannot parse OID"


I had the opportunity to verify that an ESXI 5.5 does not pose any problem, would we really have to update the esxi5.1?

Hi Toine, how are u?


So I solved my problem. I need to configure my CentOS 8 allow to work with TLS 1.0 and after that, the communication between Zabbix and VMWare works well.

Thanks.

[JTJ]

Hi, I am also new to the Zabbix implementation. I would like to know if you would have found a solution since?
I have the same problem. I have tried several solutions to otherwise monitor my ESXi5.1:

- Do an Eternal check but I have a problem with the access rights that I cannot change (it is a security constraint)
-Use an SNMP agent but I have errors like "snmp_parse_oid (): cannot parse OID"


I had the opportunity to verify that an ESXI 5.5 does not pose any problem, would we really have to update the esxi5.1?

The snmp error you described can be fixed by either using numeric OID for items or by loading the correct MIB files on the proxy or host.

[ToineToine]

First of all thank you for your quick answers, as I said I'm new with zabbix and it's nice to see that this community is active .
JTJ indeed in my case it is not obvious because I have to do everything manually but at least now I know how to solve this type of error.
Andvsila, I'm interested to know how to activate/enable TLS 1.0? because I'm having trouble finding it.

[andvsilva]

First of all thank you for your quick answers, as I said I'm new with zabbix and it's nice to see that this community is active .
JTJ indeed in my case it is not obvious because I have to do everything manually but at least now I know how to solve this type of error.
Andvsila, I'm interested to know how to activate/enable TLS 1.0? because I'm having trouble finding it.

Hi Toine, I just google it and change the openssl configuration in my case I'm using CentOS 8.2 so I change file '/etc/crypto-policies/back-ends/opensslcnf.config' and add line:

MinProtocol = TLSv1.0