How to setup PSK encryption?

[Gijs007]

I'm having trouble setting up PSK encryption between my Zabix 3.4.3 server and the Windows agent.
At first I the agent didn't start, turned out I needed to get the Zabbix 3.4.1 agent with OpenSSL support. At https://support.zabbix.com/browse/ZBXNEXT-3047

I've configured the following settings in the agent:

TLSConnect=psk
TLSAccept=psk
TLSPSKIdentity=PSK 001
TLSPSKFile=C:\zabbix\conf\psk.psk

I've successfully tested the agent with the zabbix_get.exe tool.

On the Zabbix server I've configured the same PSK identity for the host and the same PSK.

However I keep getting the following error upon restarting the agent:

  6328:20171019:200648.229 active check configuration update from [92.222.x.x:10051] started to fail (TCP successful, cannot establish TLS to [[92.222.x.x]:10051]: SSL_connect() I/O error: [0x00000000] The operation completed successfully.)

I'm not sure why it doesn't work, as unencrypted works fine.
Do I need to configure something on the Zabbix server, besides the host settings?

[andris]

You can check, maybe there is some network device (firewall?) between Windows machine and Zabbix server which allows TCP, but does not like SSL connections.
Also DebugLevel=4 (or even 5) and Wireshark/tcpdump can help.

[Gijs007]

Thanks, the debug information was more helpful.
I saw the following message:

7084:20171020:151342.223 failed to accept an incoming connection: from 92.222.x.x: unencrypted connections are not allowed

Which made me suspect the Zabbix server wasn't compiled with openssl support.
After installing the libssl-dev library and recompiling with

--with-openssl

and running make install again, Zabbix is working correctly.

I did notice something strange, Wireshark detects normal TCP packets instead of SSL/TLS. Does Zabbix only compress the data within the TCP packets, instead of using a normal SSL/TLS connection?

[andris]

You can check host settings in Zabbix frontend - Configuration -> Hosts -> (your host) -> Encryption tab.
What are "Connections to host" and "Connections from host" settings ? Are they both "PSK" ?

[Gijs007]

You can check host settings in Zabbix frontend - Configuration -> Hosts -> (your host) -> Encryption tab.
What are "Connections to host" and "Connections from host" settings ? Are they both "PSK" ?

Yes, both are set as PSK.

[andris]

Then DebugLevel=4 on server AND agent should give some hint what goes out and what comes in.

[Gijs007]

I think it's working, as Zabbix is receiving data from the agent.
However as I mentioned earlier Wireshark doesn't recognize the traffic as SSL/TLS.

[andris]

Nothing special with Zabbix TLS, Wireshark should recognize it.

[andris]

.. as TLS 1.2

[Gijs007]

Wireshark is only detecting protocol TCP over here. This doesn't make sense as the encryption is enforced both ways, on the agent and server.

I can't recognize any of the data the agent is transmitting, except for the PSK identifier.
I'm uncertain if the data is encrypted or not.

[andris]

Wireshark is only detecting protocol TCP over here. This doesn't make sense as the encryption is enforced both ways, on the agent and server.

I can't recognize any of the data the agent is transmitting, except for the PSK identifier.
I'm uncertain if the data is encrypted or not.

PSK identifier in clear text is a good sign - and, yes, it goes unencrypted just to inform receiving side which PSK to use further. Zabbix server can use a different PSK and PSK identifier for each agent.

As of Wireshark - try to select SSL as protocol for decoding captured traffic (Edit->Preferences->Protocols->SSL - something like that?). You should see TLS 1.2 protocol headers (e.g. ciphersuites selection), not decrypted Zabbix data (although you can google how to decrypt data too).

[andris]

To investigate if data are encrypted or not you can, for example, replace encryption-enabled Zabbix agent with a combination of agent without encryption support and Stunnel and see does it work with encryption-enabled Zabbix server. For both - passive and active checks - you will need 2 Stunnel instances.
It takes time to set up, but should work.

[Gijs007]

I managed to make Wireshark detect it as TLS 1.2 traffic.
Had to right click on the traffic > decode as and set it to SSL.

Guess Wireshark only automatically determines the protocol bases on port number (E.g. 443), instead of analysing the traffic and finding matching protocols.