Unencrypted connections are not allowed

[Mandalorian4Life]

Hi,
I've been troubling myself these days with learning to setup zabbix to monitor Windows 2016 server(s).
Server is deployed on Centos7, agent is on W2016 Srv Std.

I've configured PSK on both sides (agent.conf on W2016 and on Zabbix frontend for same host). Checks are working, W2016 sends its data to ZBX, but...

There are lines in log that point that either something is wrong with agent logging errors to log, or it doesn't really works.
This is what I get in Agent Log:


8652:20200414:150739.470 Starting Zabbix Agent [myWin2016.domain.loc]. Zabbix 4.0.17 (revision a528a0a4bc).
8652:20200414:150739.470 **** Enabled features ****
8652:20200414:150739.471 IPv6 support: YES
8652:20200414:150739.472 TLS support: YES
8652:20200414:150739.473 **************************
8652:20200414:150739.473 using configuration file: C:\Program Files\Zabbix Agent\zabbix_agentd.conf
8652:20200414:150739.561 agent #0 started [main process]
7120:20200414:150739.562 agent #1 started [collector]
6172:20200414:150739.563 agent #2 started[listener #1]
7788:20200414:150739.564 agent #3 started[listener #2]
8696:20200414:150739.564 agent #4 started[listener #3]
8564:20200414:150739.565 agent #5 started [active checks #1]
7788:20200414:150755.670 failed to accept an incoming connection: from 192.168.1.1 : unencrypted connections are not allowed

Agent Conf:

#########

LogFile=C:\Program Files\Zabbix Agent\zabbix_agentd.log

DebugLevel=3

EnableRemoteCommands=1

LogRemoteCommands=1

Server=192.168.1.1

StartAgents=3

ServerActive=192.168.1.1

Hostname=myWin2016.domain.loc

HostMetadata=Windows

HostMetadataItem=system.uname

TLSConnect=psk

TLSAccept=psk

TLSPSKIdentity=PSK001

TLSPSKFile=C:\Program Files\Zabbix Agent\psk.key

#########

On frontend, host is "green" both ZBX and both PSKs, meaning that correct PSK id and key and hostname are ok in Zabbix web gui.

I've checked firewall, read documentation, but still haven't solved this.

What am I missing and where.

Thanks.

[Mandalorian4Life]

Srsly, not anyone?
Everyone have working Agent Acitve Checks with PSK on W2016?

[andris]

failed to accept an incoming connection: from 192.168.1.1 : unencrypted connections are not allowed

Main question - do passive checks work, are they getting data ?
If yes, then it is something else conecting to agent from 192.168.1.1.
If no - then you can check and compare log files on both ends (server/proxy and agent).

[Mandalorian4Life]

Yap, passive works.
I've allowed connection to agent host on port 10050 only from 192.168.1.1 in firewall, and netstat on Centos is showing that only zabbix_server is trying to connect to host to 10050, meaning nothing else is tryin to make connection or using port...

It's interesting that active works when I turn off encryption. This can lead to conclusion that (and it is stated on msoft tech library pages) W2016 does not support TLSv1.2 PSK-AES128-CBC-SHA, but then again, how does it sends out to Zabbix server using this same encryption (???).

From Level4 log:
3024:20200421:193259.175 In zbx_tls_accept()
3024:20200421:193259.176 zbx_psk_server_cb() requested PSK identity "PSK001"
3024:20200421:193259.177 End of zbx_tls_accept():SUCCEED (established TLSv1.2 PSK-AES128-CBC-SHA)

I think I'll sniff around Centos and Zabbix Server how to set proper psk cipher that is supported by W2016.

Any other ideas?

[maha]

Zabbix newbie reporting in.

I have some of the same issues with W2019 (Domain Controller).

Disabling passive-TLS results in no errors in logfile for active checks, but when I enable it, it gives me same error as stated in thread topic.

DebugLevel 4 also reveal this:
The server-side authentication level policy does not allow the user <user used for LDAP queries> from address <IP of firewall> to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application.

Other entries from log:
2022/01/27 10:40:05.024632 sending passive check response: '10.755340' to 'zabbix server IP'
2022/01/27 10:40:05.024937 sending passive check response: '1132.000000' to 'zabbix server IP'
2022/01/27 10:40:05.030113 connection established using TLSv1.3 TLS_CHACHA20_POLY1305_SHA256


Re-enable passive-TLS:

2022/01/27 10:50:11.187730 [101] no active checks on server [10.100.80.48:10051]: connection of type "TLS with PSK" is not allowed for host "domain controller"
2022/01/27 10:50:11.187730 [101] End of refreshActiveChecks() from [zabbix server IP:10051]



My config file looks like this:

##### Passive checks related

Server=zabbix server IP
# ListenPort=10050

##### Active checks related

ServerActive=zabbix server IP
Hostname=domain controller

# HostMetadata=

############ ADVANCED PARAMETERS #################

Include=C:\Program Files\Zabbix Agent 2\zabbix_agent2.d\
ControlSocket=\\.\pipe\agent.sock

DebugLevel=4

####### TLS-RELATED PARAMETERS #######

### Option: TLSConnect
# How the agent should connect to server or proxy. Used for active checks.
TLSConnect=psk

### Option: TLSAccept
# What incoming connections to accept.
TLSAccept=psk

TLSPSKIdentity=PSKX
TLSPSKFile=C:\Program Files\Zabbix Agent 2\psk.key

[cyber]

Hosts config and encryption tab, is everything ok there? Connection from host allowed with encryption?

[rthonpm]

Is the host configured in the Zabbix frontend to use the same PSK and to only accept encrypted data?

Both the client and server have to be configured for encryption and must also agree on the same key name and value.

Sent from my BBE100-5 using Tapatalk

[maha]

Yep, host is configured with correct IP and Agent ifc. PSK is selected on both encryption directions. See attached image.

Seems like passive encryption is a no-go - cause non-encrypted passive works fine, active encryption works fine.

[rthonpm]

That's interesting. I've never seen encryption work with just one or the other (active/passive): it's always either worked on not worked. If you click on the PSK button at the bottom of the page: are the values there correct for the key you're using?

Any difference if you change the file name in your Windows config file from .key to .psk?

What user is running the Zabbix agent in Windows? Ideally, it should be the SYSTEM account.

[maha]

Sorry for my late response.

Yeah, pretty sure the PSK is the same - I've copy-pasted it back and forth so many times now, but did it again just to be sure - and then I renamed the .key to .psk as you mentioned.
The service is running on the local system account.

Restarted the service now, and about 10 minutes after that, the "cannot process incoming connection: cannot accept unencrypted connection" logging appears :/

[mattyj2001]

I realize this is an ancient thread but was running into a situation where the encrypted connection was working, but it was throwing the "unencrypted connections are not allowed" errors in the agent log, and the host was showing as 'Unavailable'. Though data was being sent.

Just an aesthetic problem but turns out you can select "No encryption" on the host even when you have encryption set up. Once you click on "PSK" the errors go away.