[ZBX-24987] Zabbix agent 2 not working on RedHat 8 (FIPS) Created: 2024 Aug 07  Updated: 2024 Aug 08  Resolved: 2024 Aug 08

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G)
Affects Version/s: 7.0.2
Fix Version/s: None

Type: Problem report Priority: Trivial
Reporter: Martin Vancl Assignee: Zabbix Support Team
Resolution: Duplicate Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Duplicate
duplicates ZBXNEXT-6591 Nist/Fips support Open

 Description   

Zabbix agent 2 does not work on RedHat 8 (FIPS).

I first noticed the problem with zabbix_agent2 6.0.17, and now I tested 7.0.2, and it still doesn't work.

 

Red Hat Enterprise Linux 8.10

# openssl version
OpenSSL 1.1.1k  FIPS 25 Mar 2021

# zabbix_agent2 --version | head -n1
zabbix_agent2 (Zabbix) 7.0.2

 

 

Steps to reproduce:

  1. Install 
    yum install https://repo.zabbix.com/zabbix/7.0/rhel/8/x86_64/zabbix-agent2-7.0.2-release1.el8.x86_64.rpm
  1. Add config: 
    ControlSocket=/tmp/agent.sock
    LogFile= /var/log/zabbix/zabbix_agent2.log
    LogFileSize=10
    Server=zabbix-proxy.pokus.cz
    ServerActive=zabbix-proxy.pokus.cz
    Hostname=xxx.pokus..cz
    HostMetadata=Linux xx
    Timeout=30
    TLSConnect=psk
    TLSAccept=psk
    TLSPSKIdentity=autoregistration
    TLSPSKFile=/etc/zabbix/zabbix_agentd.psk
    Include=/etc/zabbix/zabbix_agentd.d/
    PidFile=/run/zabbix/zabbix_agentd2.pid
    UnsafeUserParameters=1 
  1. Run agent2
  2. It crash.

Result:
In zabbix_agent2 log there is this error: 

2024/08/07 17:18:32.942491 [101] cannot connect to [zabbix-proxy.pokus.cz:10051]: 139637872441088:error:0607B0C8:digital envelope routines:EVP_CipherInit_ex:disabled for FIPS:crypto/evp/evp_enc.c:227:
139637872441088:error:14202006:SSL routines:derive_secret_key_and_iv:EVP lib:ssl/tls13_enc.c:427:
2024/08/07 17:18:32.942532 [101] active check configuration update from host [xxx.pokus.cz] started to fail 

The only workable solution is to use zabbix_agent1 and set:

TLSCipherPSK13=TLS_AES_128_GCM_SHA256 

For zabbix_agent2, the TLSCipherPSK13 option is not available.
**

Expected:
Working zabbix_agent2.

The server is behind Zabbix proxy 7.0.2 on Ubuntu 22.04. Other servers (Debian/Ubuntu) don't have any problems, and zabbix_agent2 works great.



 Comments   
Comment by Alexey Pustovalov [ 2024 Aug 08 ]

Hello! Currently Zabbix does not support FIPS officially. Please follow and vote ZBXNEXT-6591 for feature request. Closing as duplicate.

Generated at Sat Jul 05 08:40:07 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.