Agent Authentication (possibly for 1.6)

[supersport]

We have a distributed environment with several (separate) networks, each with a variety of PCs and Servers. To make matters worse, many of our users are mobile and take their laptops with them on the road. We can monitor our "static" systems fairly easily with hierarchical monitoring, but we'd love to have an agent on every pc/system out there.

What I'd like to propose is a username/password authentication method for agents. Right now, it seems that the agent daemon connects to the server, at which time the server correlates the "from" ip to a host record. I would propose that we have an alternative method with the above user/pass. This way, a user could be mobile (or have DHCP, or be behind a non-static IP) and have a "clean" way to consistently connect properly. This would seem to eliminate having to use dyndns, ssh tunneling, etc.

I've looked around on the forums, and have not seen this feature, but I admit that I haven't looked terribly closely.

Is this a feature that could be useful to others? Is it already on the roadmap? Has this already been discussed and dismissed?

Any thoughts and/or feedback would be greatly appreciated.

[Alexei]

We already have encryption in our roadmap for 1.6. However it is still not quite clear what kind of encryption will be implemented for agents. Most probably it would be something symmetric, which does not have huge processing overhead. If we decide to implement more complex solution (like, TLS, whetever), the authentication will be automatically built-in the communication/transport layer.

Your idea is a nice combination of simplicity and efficiency. Added to ZABBIX wishlist for further evaluation.

[Calimero]

Maybe some certificate-based authentication ?

ie: you would have a "Certification Authorithy" for your Zabbix Server which would sign client certificates (as in OpenVPN).

[Alexei]

Maybe some certificate-based authentication ?

I expect HUGE performance problems even for hundreds of such agents reporting frequently to ZABBIX server. This would be possible when agents learn to send multiple values per each connection.

[Calimero]

If I recall correctly SSL (and libssl) has a "session caching" mecanism to avoid handshaking all over again on subsequent connections: SSL parameters are to some extent recovered from a session ID.

There are Apache directives to specify where to store that "SSL scoreboard".

OpenVPN on the other hand uses UDP packets and there must also a caching mecanism.

I honestly don't know how the caching mecanism works. But anyway, SSL never comes for free (although hardware like VIA's C7 can really help).