Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-24987

Zabbix agent 2 not working on RedHat 8 (FIPS)

XMLWordPrintable

    • Icon: Problem report Problem report
    • Resolution: Duplicate
    • Icon: Trivial Trivial
    • None
    • 7.0.2
    • Agent (G)
    • None

      Zabbix agent 2 does not work on RedHat 8 (FIPS).

      I first noticed the problem with zabbix_agent2 6.0.17, and now I tested 7.0.2, and it still doesn't work.

       

      Red Hat Enterprise Linux 8.10
      
      # openssl version
      OpenSSL 1.1.1k  FIPS 25 Mar 2021
      
      # zabbix_agent2 --version | head -n1
      zabbix_agent2 (Zabbix) 7.0.2

       

       

      Steps to reproduce:

      1. Install 
        yum install https://repo.zabbix.com/zabbix/7.0/rhel/8/x86_64/zabbix-agent2-7.0.2-release1.el8.x86_64.rpm
      1. Add config: 
        ControlSocket=/tmp/agent.sock
        LogFile= /var/log/zabbix/zabbix_agent2.log
        LogFileSize=10
        Server=zabbix-proxy.pokus.cz
        ServerActive=zabbix-proxy.pokus.cz
        Hostname=xxx.pokus..cz
        HostMetadata=Linux xx
        Timeout=30
        TLSConnect=psk
        TLSAccept=psk
        TLSPSKIdentity=autoregistration
        TLSPSKFile=/etc/zabbix/zabbix_agentd.psk
        Include=/etc/zabbix/zabbix_agentd.d/
        PidFile=/run/zabbix/zabbix_agentd2.pid
        UnsafeUserParameters=1 
      1. Run agent2
      2. It crash.

      Result:
      In zabbix_agent2 log there is this error: 

      2024/08/07 17:18:32.942491 [101] cannot connect to [zabbix-proxy.pokus.cz:10051]: 139637872441088:error:0607B0C8:digital envelope routines:EVP_CipherInit_ex:disabled for FIPS:crypto/evp/evp_enc.c:227:
      139637872441088:error:14202006:SSL routines:derive_secret_key_and_iv:EVP lib:ssl/tls13_enc.c:427:
      2024/08/07 17:18:32.942532 [101] active check configuration update from host [xxx.pokus.cz] started to fail 

      The only workable solution is to use zabbix_agent1 and set:

      TLSCipherPSK13=TLS_AES_128_GCM_SHA256 

      For zabbix_agent2, the TLSCipherPSK13 option is not available.
      **

      Expected:
      Working zabbix_agent2.

      The server is behind Zabbix proxy 7.0.2 on Ubuntu 22.04. Other servers (Debian/Ubuntu) don't have any problems, and zabbix_agent2 works great.

            zabbix.support Zabbix Support Team
            tuxmartin Martin Vancl
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: