Zabbix proxy was compiled without TLS support

[V.Reddy]

Hi,

I have installed zabbix-proxy from zabbix repository.
yum install zabbix-proxy-mysql

And i have followed below steps to enable PSK encryption.

Configuring PSK for server - active proxy communication (example)

On the proxy, write the PSK value into a file, for example, /home/zabbix/zabbix_proxy.psk. The file must contain PSK in the first text string, for example:

e560cb0d918d26d31b4f642181f5f570ad89a390931102e539 1d08327ba434e9
Set access rights to PSK file - it must be readable only by Zabbix user.

Edit TLS parameters in proxy configuration file zabbix_proxy.conf, for example, set:

TLSConnect=psk
TLSPSKFile=/home/zabbix/zabbix_proxy.psk
TLSPSKIdentity=PSK 002
The proxy will connect to server using PSK. PSK identity will be “PSK 002”.

(To minimize downtime see how to change connection type in Connection encryption management).

Configure PSK for this proxy in Zabbix frontend. Go to Administration→Proxies, select the proxy, go to “Encryption” tab. In “Connections from proxy” mark PSK. Paste into “PSK identity” field “PSK 002” and “e560cb0d918d26d31b4f642181f5f570ad89a390931102e53 91d08327ba434e9” into “PSK” field. Click “Update”.

Restart proxy. It will start using PSK-based encrypted connections to server. Check server and proxy logfiles for error messages.

For a passive proxy the procedure is very similar. The only difference - set TLSAccept=psk in proxy configuration file and set “Connections to proxy” in Zabbix frontend to PSK.

https://www.zabbix.com/documentation/3.2/manual/encryption/using_pre_shared_keys

When i configure zabbix-proxy to communicate with server using PSK and restarting zabbix-proxy failed to start and shows below error message,

Starting Zabbix proxy: zabbix_proxy [12288]: "TLSConnect" configuration parameter cannot be used: Zabbix proxy was compiled without TLS support
zabbix_proxy [12288]: "TLSPSKIdentity" configuration parameter cannot be used: Zabbix proxy was compiled without TLS support
zabbix_proxy [12288]: "TLSPSKFile" configuration parameter cannot be used: Zabbix proxy was compiled without TLS support.


How to enable TLS support in zabbix-proxy installing from zabbix repo?

[andris]

"Zabbix proxy was compiled without TLS support" says it all - it was compiled without OpenSSL, GnuTLS or mbedtls library support.

https://www.zabbix.com/documentation...lation/install describes general steps how to compile Zabbix from sources.

https://www.zabbix.com/documentation...yption_support provides encryption-specific details for compilation.

[guzzijason]

What version? I'm using 3.0.x on CentOS 7 and the packages from the official repo definitely have TLS support enabled. IMHO, TLS is a *major* feature of 3.0+, and it really should be enabled by default as the future for many organizations is "TLS ALL THE THINGS".

__Jason

[andris]

If there is "Zabbix proxy was compiled without TLS support" message on start I don't think you can somehow "unlock" TLS support.
Consider compiling Zabbix binaries from source - it is not difficult.
Your Zabbix 3.0 database is ready to support encrypted connections.
Just replace binaries with your own compiled ones. Ask questions if something is not clear.

[guzzijason]

My point is, he shouldn't have to recompile. TLS support should be standard at this point, and clearly they are already releasing packages in the official zabbix repo that have TLS enabled, so why do other packages not have it enabled? The released packages should be consistent, and TLS enabled should be the default.

Not sure if there is anyone here from the zabbix team that can offer an opinion. I would be tempted to open a bug report with them and try to get clarification on why some packages released to the repo have TLS and others don't.

I am curious, though, which os/version/package the OP is using. I'm currently using zabbix-proxy-mysql-3.0.4-1.el7 for CentOS 7 and TLS works just fine by default.

__Jason

[andris]

For example, packages for RHEL6 and 7 have TLS support enabled.
Packages for RHEL5 have no TLS support as OpenSSL 0.9.8 does not provide all features.

[guzzijason]

For example, packages for RHEL6 and 7 have TLS support enabled.
Packages for RHEL5 have no TLS support as OpenSSL 0.9.8 does not provide all features.

Ah, thanks for that clarification. Yes, if anyone is still actively deploying to RHEL (or CentOS) 5, well... they shouldn't be! If that's the case, then I wish them the best of luck, because they will be having all sorts of problems resulting from the use of deprecated OS.

__Jason

[andris]

If compiling from source is acceptable I think you can get a working Zabbix 3.x with TLS even on RHEL 5 - just compile OpenSSL (1.0.1 or newer) or GnuTLS (3.1.18 or newer) from source and link Zabbix with it.

[V.Reddy]

If compiling from source is acceptable I think you can get a working Zabbix 3.x with TLS even on RHEL 5 - just compile OpenSSL (1.0.1 or newer) or GnuTLS (3.1.18 or newer) from source and link Zabbix with it.

Hi,

Thanks for the clarification. In my environment one of the proxy server is configured on centos 5.11 system.


/V.Reddy