SSH connection and log files

[Lazareus]

Hi all,


I'm writing here for the first time.

I'm new in Zabbix, i'm gonna deploy it in my company and i need an answer of some questions.


Is it possible to encapsulate the connections port 10050 and 10051 between zabbix server and proxy in an ssh tunnel ?

How can i do it if it's possible ?

Do i need to change some parameters in my zabbix_server.conf ? Or in another configuration file ?

Last question : How can i retrieve log files from host applications to my server using zabbix ?


Thanks for your help.

[BDiE8VNy]

Yes, this is possible. Although Zabbix server and Zabbix proxy make only use of TCP port 10051.
If it's just about encryption, then be aware that this is going to be solved nicely with Zabbix 3.0. See Encryption.

## zabbix-proxy-active -- SSH --> zabbix-server
# ssh -L 127.0.0.1:49152:127.0.0.1:10051 zabbix-server

## zabbix-server -- SSH --> zabbix-proxy-active
# ssh -R 127.0.0.1:49152:127.0.0.1:10051 zabbix-proxy-active

[Lazareus]

Thank you for your answer.

If i understand you, it is not possible to use another port for communication between the server and the proxy? Because even if i use encryption, the 10051 port should stay open in the firewall for the communication, is that correct?

There is no other way to do this properly?

[BDiE8VNy]

Well, you can configure whatever port number you prefer - in Zabbix as well as for the SSH tunnel.
Finally it depends what you actually want to achieve - what is not obvious to me yet

If Zabbix's native encryption is going to be used, then there will be no dedicated port for encrypted communication. Both, encrypted as well as unencrypted communication share the same port.

[Lazareus]

Ok, so if i specify my port connection in my conf files (zabbix_server and zabbix_agentd), i'll be able to pass the firewall through this port? The 10050 and 10051 ports will be able to be close?

[BDiE8VNy]

Yes (if I've understood you correctly). A Zabbix daemon listens resp. opens the port configured in its configuration file only. A firewall between e.g. Zabbix server and Zabbix agent has still to allow traffic to the configured port.

[Lazareus]

Hum ... That sounds good for me as i'm only able to use SSH 22 connection to run Zabbix in my company.

Last question : Do you know if it is possible to tell Zabbix to initiate connections only from server to proxy/agent? Or maybe it does natively? I have some demilitarized areas in my network and i have only the right to open SSH connection from my LAN to the areas and not from the areas to my LAN.

[BDiE8VNy]

When you configure a Zabbix proxy for a Zabbix host, then communication happens via proxy only. There will be for instance no direct access from Zabbix server to Zabbix agent. Well, except of remote commands. But that is going to be fixed soon. See: ZBXNEXT-936

In your case just put a Zabbix proxy in your DMZ, decide in which direction the communication should happen (Zabbix server to Zabbix proxy or vice versa) and finally ensure to configure that proxy in Zabbix frontend for respective hosts in your DMZ.
See: Concetp of proxies, Proxy based distributed monitoring and Host configuration.

[Lazareus]

Ok. I'm not pretty sure the encryption will work in my architecture but for the rest, i will follow your instructions.

When you ask me to:

"decide in which direction the communication should happen (Zabbix server to Zabbix proxy or vice versa)"

Are you talking about proxy mode ? (Passive or Active)


Thanks for your help.

[BDiE8VNy]

That's exactly what I was referring to, yes.

[Lazareus]

Excellent !


Now i need only one more answer in another topic i've created and i'll be ready to deploy and test Zabbix in my company.


Thank you very much for your help and support !


PS: in case you can help me in this thread too : https://www.zabbix.com/forum/showthread.php?t=51032

[BDiE8VNy]

Your welcome.

As for the other thread, let's see whether someone else has something to say first