Authentication Questions and 2FA

[RyanOxon]

Hello,

We are looking to deploy Zabbix and potentially want to provide clients with access to it, this means exposing it to the internet. Ideally we would like 2FA if this is going the be the case.

Is anyone able to give us an insight on how they are currently handling this? We have seen the patched version of Zabbix here https://github.com/BGmot/zabbix but we are reluctant to use this if it may cause issues updating
in the future, also we use Postgres as the DB and this patch uses MYSQL. We also looked at using an external SAML service but this still allows the user to login with internal credentials without 2FA. Ideally we would like
any login to the system to use 2FA. The only other way I can see to do this would be to use Web Authentication through Apache but this does not seem well documented.

We are currently using version 6.0.3

Any ideas would be great.

Thank you.

[Hamardaban]

The Zabbix interface is accessed via a web server ( Apache or Nginx )
Do 2AF at the web server level, not zabbix.

[RyanOxon]

Just to follow up on this post if other people are looking at the same problem. We ended up using HTTP auth using a reverse proxy and the NGINX auth_request directive, this seems to work well for Zabbix.

[ditkar]

Could you please help me with steps on how to do this? Is there a link or so to follow the guidelines?