Docker issue using psk encryption

[trantor]

Hello,
I'm trying to add psk encryption to my zabbix proxy containers but I'm a noob witch docker and got error about /var/lib/zabbix/enc/secret.psk file not found.

I'm passing these arguments when I run the container:
-e ZBX_TLSCONNECT=psk -e ZBX_TLSPSKIDENTITY=xxxx -e ZBX_TLSPSKFILE=/var/lib/zabbix/enc/secret.psk

But the container "crash" when starting with :

** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSConnect": 'psk'...updated
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSAccept": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSCAFile": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSCRLFile": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSServerCertIssuer": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSServerCertSubject": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSCertFile": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSCipherAll": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSCipherAll13": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSCipherCert": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSCipherCert13": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSCipherPSK": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSCipherPSK13": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSKeyFile": ''...removed
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSPSKIdentity": '****'. Enable DEBUG_MODE to view value ...updated
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "TLSPSKFile": '/var/lib/zabbix/enc/secret.psk'...updated
** Updating '/etc/zabbix/zabbix_proxy.conf' parameter "User": 'zabbix'...updated
Starting Zabbix Proxy (active) [zabbix-proxy-xxx]. Zabbix 7.0.0rc1 (revision 0dbfbe9).
Press Ctrl+C to exit.

8:20240506:153651.942 Starting Zabbix Proxy (active) [zabbix-proxy-xxx]. Zabbix 7.0.0rc1 (revision 0dbfbe9).
8:20240506:153651.942 **** Enabled features ****
8:20240506:153651.942 SNMP monitoring: YES
8:20240506:153651.943 IPMI monitoring: YES
8:20240506:153651.943 Web monitoring: YES
8:20240506:153651.943 VMware monitoring: YES
8:20240506:153651.943 ODBC: YES
8:20240506:153651.943 SSH support: YES
8:20240506:153651.943 IPv6 support: YES
8:20240506:153651.943 TLS support: YES
8:20240506:153651.943 **************************
8:20240506:153651.943 using configuration file: /etc/zabbix/zabbix_proxy.conf
8:20240506:153652.002 current database version (mandatory/optional): 06050287/06050287
8:20240506:153652.002 required mandatory version: 06050287
8:20240506:153652.027 proxy #0 started [main process]
152:20240506:153652.029 proxy #1 started [configuration syncer #1]
152:20240506:153652.040 cannot open file "/var/lib/zabbix/enc/secret.psk": [2] No such file or directory
8:20240506:153653.029 One child process died (PID:152,exitcode/signal:1). Exiting ...
8:20240506:153653.050 Zabbix Proxy stopped. Zabbix 7.0.0rc1 (revision 0dbfbe9).

Because the container is not running I can't touch "/var/lib/zabbix/enc/secret.psk" file.

So my question is : how to properly pass the pre-shared key argument to the container ?

Thank you for you help

Regards

[kyus]

Hey!
This happens because the secret.psk file doesn't exist in the container. You can add this parameter to your docker run command "-v /path/to/psk/in/your/server/secret.psk:/var/lib/zabbix/enc/secret.psk"

So you'll need to create your psk and store it in a file. Let's say "openssl rand -hex 32 > /tmp/secret.psk"
Then you'll replace "path/to/psk/in/your/server/secret.psk" with "/tmp/secret.psk"

[trantor]

Hi,
Ok thanks for the tip, I will try that