Hello,
I'm running a Zabbix-Server 3.0.7 (1:3.0.7+dfsg-3) on Debian 9.
I have this monitoring a number of remote VPS (and local hosts) all running Zabbix-Agent 3.0.7 (3.0.7+dfsg-3) also all on Debian 9.
The agents are configured passively. I'm using TLS with PSK for each of the above for connections from the Zabbix Server. I have generated keys as follows:
This all works pretty much as you'd expect it too - 100% success rate. Until yesterday anyway...
I installed zabbix-agent and zabbix-proxy-mysql (v3.0.7+dfsg-3 with prerequisites) on a Debian 9 box. I configured both the proxy and agent as passive, gave them unique PSK Identities and generated new PSK files as above.
When the zabbix-server attempts to connect to the zabbix-agent running on the box, I see:
On the zabbix-server:
On seeing the client error message, my first thought is that I've chosen a duff PSK, PSK ID or not given the file the correct permissions...
I've tried different length keys (ranging from 32-bit to 2048-bit), I've tried copying keys from other boxes which I know work, I've tried adding and removing carriage returns (new line) from the end of the PSK file.
Also tested with zabbix_get:
I've also checked that the same version of libgnutls is installed on all of the debian hosts
I have the config, detailed logs (DebugLevel = 5) and packet captures, which, I will add them to the thread shortly.
This is incredibly frustrating - hopefully I've missed something blindingly obvious and one of you kind people can point it out to me
I'm running a Zabbix-Server 3.0.7 (1:3.0.7+dfsg-3) on Debian 9.
I have this monitoring a number of remote VPS (and local hosts) all running Zabbix-Agent 3.0.7 (3.0.7+dfsg-3) also all on Debian 9.
The agents are configured passively. I'm using TLS with PSK for each of the above for connections from the Zabbix Server. I have generated keys as follows:
Code:
# openssl rand -hex 32 > /etc/zabbix/zabbix_agent_psk # chmod 0400 /etc/zabbix/zabbix_agent_psk # chown zabbix:zabbix /etc/zabbix/zabbix_agent_psk
I installed zabbix-agent and zabbix-proxy-mysql (v3.0.7+dfsg-3 with prerequisites) on a Debian 9 box. I configured both the proxy and agent as passive, gave them unique PSK Identities and generated new PSK files as above.
When the zabbix-server attempts to connect to the zabbix-agent running on the box, I see:
Code:
20194:20181213:150329.754 zbx_tls_accept() gnutls_handshake() returned: -31 Error in password file. 20194:20181213:150329.755 failed to accept an incoming connection: from <SERVER_PUBLIC_IP>: zbx_tls_accept(): gnutls_handshake() failed: -31 Error in password file.
Code:
4374:20181213:112609.840 Get value error: TCP successful, cannot establish TLS to [[zabbix_agent_host.somedomain.sometld]:10050]: zbx_tls_connect(): gnutls_handshake() failed: -110 The TLS connection was non-properly terminated.
Code:
root@pashley:/etc/zabbix# ls -altr total 52 drwxr-xr-x 2 root root 4096 Jun 4 2017 zabbix_proxy.conf.d drwxr-xr-x 2 root root 4096 Dec 11 21:26 zabbix_agentd.conf.d -rw-r--r-- 1 root root 0 Dec 11 21:36 proxySchema.done drwxr-xr-x 95 root root 4096 Dec 12 23:08 .. -r--r----- 1 zabbix zabbix 66 Dec 12 23:59 zabbix_proxy_psk -rw-r--r-- 1 root root 16012 Dec 13 11:08 zabbix_proxy.conf -r-------- 1 zabbix zabbix 65 Dec 13 12:39 zabbix_agent_psk -rw-r--r-- 1 root root 10426 Dec 13 13:01 zabbix_agentd.conf drwxr-xr-x 4 root root 4096 Dec 13 13:01 .
Code:
root@pashley:/etc/zabbix# cat zabbix_agent_psk 6bebf5ca66a881dc2792b5d577c9fc6a4d80cc6d2496970a282400973400143a
Code:
root@pashley:/etc/zabbix# cat zabbix_proxy_psk 7c22b25925cabaffeb24d5580714eaeb88f1d66db422e216d8e43506e36a4ca9
Also tested with zabbix_get:
Code:
sudo zabbix_get -s zabbix_agent_host.somedomain.sometld -p 10050 -k "system.cpu.load[all,avg1]" --tls-connect=psk --tls-psk-identity="PSK_010" --tls-psk-file="/home/user/zabbixAgentTestPsk" zabbix_get [25159]: Get value error: TCP successful, cannot establish TLS to [[zabbix_agent_host.somedomain.sometld]:10050]: zbx_tls_connect(): gnutls_handshake() failed: -110 The TLS connection was non-properly terminated.
Code:
root@pashley:/etc/zabbix# dpkg -l | grep gnutls ii libcurl3-gnutls:amd64 7.52.1-5+deb9u8 amd64 easy-to-use client-side URL transfer library (GnuTLS flavour) ii libgnutls30:amd64 3.5.8-5+deb9u4 amd64 GNU TLS library - main runtime library
This is incredibly frustrating - hopefully I've missed something blindingly obvious and one of you kind people can point it out to me
Comment