Zabbix Agent MSI install with PSK

[gherbstman]

I have had a Powershell script running for some time successfully. We call the MSI installer passing it parameters like this:

/qn SERVER=127.0.0.1 SERVERACTIVE=zabbix.mydomain.com,149.xx.xx.xx TLSCONNECT=psk TLSACCEPT=psk TLSPSKIDENTITY=MyIdentity TLSPSKVALUE=[a proper key] SKIP=fw

Recently it is failing on the MSI install with the error: PSK value field is not a valid 128-2048 bit Hex
Zabbix agent v6.2.4

We have tried a number of freshly generated PSK values They all fail with the same error. We know the PSK is proper. If we manually update the config file with the same PSK the agent starts and properly communicates.

Best I can tell is there is something with the checking in the installer routines that always invalidates the PSK.

Is anyone else seeing this seeing this issue?

[judgewolf]

I have had a Powershell script running for some time successfully. We call the MSI installer passing it parameters like this:

/qn SERVER=127.0.0.1 SERVERACTIVE=zabbix.mydomain.com,149.xx.xx.xx TLSCONNECT=psk TLSACCEPT=psk TLSPSKIDENTITY=MyIdentity TLSPSKVALUE=[a proper key] SKIP=fw

Recently it is failing on the MSI install with the error: PSK value field is not a valid 128-2048 bit Hex
Zabbix agent v6.2.4

We have tried a number of freshly generated PSK values They all fail with the same error. We know the PSK is proper. If we manually update the config file with the same PSK the agent starts and properly communicates.

Best I can tell is there is something with the checking in the installer routines that always invalidates the PSK.

Is anyone else seeing this seeing this issue?

We have the same issue.
All the versions before 6.2.1 - 6.2.3 were installed in the same way without an issue.

Bump!

[gherbstman]

We wound up just removing those parameters from the installer and using PowerShell to edit the config file and restart the service. A bit of a pain in the neck. But it works.

[gherbstman]

At the same time we took the opportunity to set recovery options on the service. We still are seeing issues with the agent randomly stopping to communicate with the server. We are looking into that currently have not found much info. We find that restarting the agent service it then reconnects for x amount of time.

[judgewolf]

We wound up just removing those parameters from the installer and using PowerShell to edit the config file and restart the service. A bit of a pain in the neck. But it works.

OK but that is not the solution.
By Zabbix documentation this should work. So, there is an issue with release 100%

[gherbstman]

Absolutely it is broken. However, it may take time to fix and the workaround does, well, work.

[mcdee]

Just to mention we had the same issue with Zabbix Agent2 LTS 6.0.10
It worked up until Zabbix Agent 2 LTS 6.0.9
It wil accept the PSK value when installing with the GUI.

[markfree]

I can confirm that the Zabbix Agent 2 6.2.4 and 6.2.5 MSI package installers have a similar issue.
Previous versions had no issue with the same server.

My PS script uses other parameters and fails when installing firewall exceptions.

SCRIPT:

$argList = @('/norestart',
             '/qn',
             '/passive',
             '/l*v',
             "$zabbixDir\zabbixInstall.log",
             '/i',
             "$dirTemp\$msiAgentZabbix",
             "INSTALLFOLDER=$zabbixDir",
             "LOGFILE=$zabbixDir\zabbixAgent.log",
             "SERVER=$proxy",
             "SERVERACTIVE=$proxy",
             "HOSTNAME=$hostname",
             "ENABLEPERSISTENTBUFFER=1",
             "PERSISTENTBUFFERPERIOD=1d",
             "PERSISTENTBUFFERFILE=$zabbixDir\zabbixAgent.db",
             "ALLOWDENYKEY=AllowKey=system.run[*]",
             "HOSTMETADATA=`"windows $proxyname $metadata`"")
Start-Process msiexec.exe -Wait -PassThru -ArgumentList "$argList"

MSI Error Log:

ExecFirewallExceptions: Installing firewall exception2 Zabbix Agent 2 listen port on port , protocol 6
ExecFirewallExceptions: Error 0x800706d9: failed trying to find existing port rule
ExecFirewallExceptions: Error 0x800706d9: failed to add/update port exception for name 'Zabbix Agent 2 listen port' on port , protocol 6
CustomAction WixExecFirewallExceptionsInstall returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (F4:54) [08:00:09:652]: User policy value 'DisableRollback' is 0
MSI (s) (F4:54) [08:00:09:652]: Machine policy value 'DisableRollback' is 0
Action ended 8:00:09: InstallFinalize. Return value 3.​

Did you collect MSI installation log?

[markfree]

I found that Windows Firewall service was disabled on some hosts.
To bypass the issue, I enabled the service while maintaining the Firewall turned off.
After doing so, the installation was successful.

What still bothers me, is that, if installing with the traditional GUI, there were no issues. Only when installing with PS script it failed.
But, for now, by checking the Firewall service, I can use the MSI package with the script.

[Markku]

6.2.6rc2 seems to include something related to MSI and firewall: https://support.zabbix.com/browse/ZBX-22002

Markku