-
Problem report
-
Resolution: Duplicate
-
Trivial
-
None
-
7.0.2
-
None
Zabbix agent 2 does not work on RedHat 8 (FIPS).
I first noticed the problem with zabbix_agent2 6.0.17, and now I tested 7.0.2, and it still doesn't work.
Red Hat Enterprise Linux 8.10 # openssl version OpenSSL 1.1.1k FIPS 25 Mar 2021 # zabbix_agent2 --version | head -n1 zabbix_agent2 (Zabbix) 7.0.2
Steps to reproduce:
- Install
yum install https://repo.zabbix.com/zabbix/7.0/rhel/8/x86_64/zabbix-agent2-7.0.2-release1.el8.x86_64.rpm
- Add config:
ControlSocket=/tmp/agent.sock LogFile= /var/log/zabbix/zabbix_agent2.log LogFileSize=10 Server=zabbix-proxy.pokus.cz ServerActive=zabbix-proxy.pokus.cz Hostname=xxx.pokus..cz HostMetadata=Linux xx Timeout=30 TLSConnect=psk TLSAccept=psk TLSPSKIdentity=autoregistration TLSPSKFile=/etc/zabbix/zabbix_agentd.psk Include=/etc/zabbix/zabbix_agentd.d/ PidFile=/run/zabbix/zabbix_agentd2.pid UnsafeUserParameters=1
- Run agent2
- It crash.
Result:
In zabbix_agent2 log there is this error:
2024/08/07 17:18:32.942491 [101] cannot connect to [zabbix-proxy.pokus.cz:10051]: 139637872441088:error:0607B0C8:digital envelope routines:EVP_CipherInit_ex:disabled for FIPS:crypto/evp/evp_enc.c:227:
139637872441088:error:14202006:SSL routines:derive_secret_key_and_iv:EVP lib:ssl/tls13_enc.c:427:
2024/08/07 17:18:32.942532 [101] active check configuration update from host [xxx.pokus.cz] started to fail
The only workable solution is to use zabbix_agent1 and set:
TLSCipherPSK13=TLS_AES_128_GCM_SHA256
For zabbix_agent2, the TLSCipherPSK13 option is not available.
**
Expected:
Working zabbix_agent2.
The server is behind Zabbix proxy 7.0.2 on Ubuntu 22.04. Other servers (Debian/Ubuntu) don't have any problems, and zabbix_agent2 works great.
- duplicates
-
ZBXNEXT-6591 Nist/Fips support
- Open