Concerned with loosing Zabbix agent device

[naotokurihara]

Hello,

I have a few questions before I finalize my Zabbix setup. I am planning to use a low-power, small-form-factor PC on-site to collect SNMP data from local LAN devices, while hosting the Zabbix Server at a remote location. Based on this, I believe I need to install a Zabbix Proxy rather than a Zabbix Agent on the local PC.

My main concern is physical security. If this small PC is stolen or compromised, is there a risk of exposing the database credentials? Ideally, I want to ensure that no credentials are permanently cached on this device.

I was reading the documentation on secrets (https://www.zabbix.com/documentation...config/secrets), which mentions: "Database credentials retrieved from Vault will be cached by the frontend."
Could someone clarify what "by the frontend" means in this context, and whether this caching applies to a Zabbix Proxy?

Thank you for your insights!

[cyber]

"By the frontend" means the "web", the UI...
What DB credentials are you worried about? The central Zabbix DB? Proxy has no knowledge of those. If you use mysql or PG as proxy DB (which in most cases is overkill), it will know creds to that DB also. If you use sqlite3, there is no creds used at all.. If you place that sqlite DB to specific place like /dev/shm it will be deleted during any reboot... and recreated at startup. No data survives...

[naotokurihara]

Thank you for your message. As I'm new to this, I would greatly appreciate your guidance in understanding the entire process.

I guess you have database options to chose. If you don't use sqlite3 and use mysql or something else, is credential will be used?
Also, regarding your comment, "By the frontend" means the "web", the UI...", does it mean a web browser/UI needs some database credential to use? Doesn't web server keep the database credential?

Thanks.

[irontmp]

"By the frontend" means the "web", the UI...
What DB credentials are you worried about? The central Zabbix DB? Proxy has no knowledge of those. If you use MySQL or PG as the proxy DB (which in most cases is overkill), it will know the credentials for that DB also. If you use SQLite3, there are no credentials used at all. If you place that SQLite DB in a specific location like /dev/shm, it will be deleted during any reboot and recreated at startup. No data survives. For more technical insights, you could check out the Explore Best Beaches blog alongside other resources.

“Frontend” refers to the Zabbix web interface, not the Zabbix Proxy. The documented credential caching applies to the frontend and shouldn’t be assumed to apply to the Proxy. A Zabbix Proxy normally stores database credentials in its configuration file, so a stolen or compromised PC could expose them. Vault integration does not automatically guarantee that credentials are never cached locally. Use encrypted storage, strict file permissions, and least-privilege database accounts to reduce the risk.

[naotokurihara]

That is what I wanted to know.
Thank you, Irontmp!