Zabbix Vault

[Amiram]

I'm trying to setup my Zabbix Server to work with the new Vault system (supported since 5.2

https://www.zabbix.com/documentation/5.2/manual/appendix/config/zabbix_server

).

I'm trying to get my DB username and password from the vault server so I set up the three required params:

• VaultDBPath
• VaultToken
• VaultURL

After restarting the server service I'm getting the following error in the server log file:

cannot initialize database credentials from vault: Cannot perform request: SSL certification problem: unable to get local issuer cerificate

Thanks

[Amiram]

Any idea here?

[rcastro33]

Hello Amiram,

I had the same issue with a Docker deployment of Zabbix Server and Vault. Zabbix don't trust in self-signed certificates unless you allow it, adding a custom CA.

What I've done is set the SSLCALocation parameter to a folder that has been prepared with my CA, using the Openssl c_rehash utility. I've copy the .pem certificate to that folder, and then use this utility.

A note about this, is that the Common Name of the certificate must be valid, that means that must match the hostname. Otherwise, you can see a similar error:

"cannot initialize database credentials from vault: Cannot perform request: SSL: certificate subject name 'nginx-docker' does not match target host name 'vault-nginx'"

See https://www.zabbix.com/documentation...onfiguring-tls for more details.

Good luck!

[ramasamy]

hi, does Zabbix request for new vault token when the value provided in "VaultToken" param expires?

[Glencoe]

No, it doesn't

[ramasamy]

hi, I'm facing another issue while trying to configure it with the enterprise vault

Params provided in config:
VaultToken=XXXXXXXXXXXXXXXXXX
VaultURL=https://vault-dev.yourorg.com:8XXX
VaultDBPath=secret/dev/00111111/zabbix

Zabbix seems to be including 'data' in the path after 'secret', so I'm getting 403 permission denied error from the vault

2031597:20220310:064707.659 In zbx_http_get() URL 'https://vault-dev.yourorg.com:8XXX/v1/secret/data/dev/00111111/zabbix'
2031597:20220310:064707.697 End of zbx_http_get():SUCCEED
2031597:20220310:064707.697 cannot initialize database credentials from vault: unsuccessful response code "403"

[Glencoe]

Zabbix includes "data" in accordance with Vault Secrets Engine v2 convention:

Writing and reading versions are prefixed with the data/ path.

(https://www.vaultproject.io/docs/secrets/kv/kv-v2)

Perhaps you use Secrets Engine v1 which Zabbix does not support.