[ZBX-24987] Zabbix agent 2 not working on RedHat 8 (FIPS) Created: 2024 Aug 07 Updated: 2024 Aug 08 Resolved: 2024 Aug 08 |
|
Status: | Closed |
Project: | ZABBIX BUGS AND ISSUES |
Component/s: | Agent (G) |
Affects Version/s: | 7.0.2 |
Fix Version/s: | None |
Type: | Problem report | Priority: | Trivial |
Reporter: | Martin Vancl | Assignee: | Zabbix Support Team |
Resolution: | Duplicate | Votes: | 0 |
Labels: | None | ||
Remaining Estimate: | Not Specified | ||
Time Spent: | Not Specified | ||
Original Estimate: | Not Specified |
Issue Links: |
|
Description |
Zabbix agent 2 does not work on RedHat 8 (FIPS). I first noticed the problem with zabbix_agent2 6.0.17, and now I tested 7.0.2, and it still doesn't work.
Red Hat Enterprise Linux 8.10 # openssl version OpenSSL 1.1.1k FIPS 25 Mar 2021 # zabbix_agent2 --version | head -n1 zabbix_agent2 (Zabbix) 7.0.2
Steps to reproduce:
Result:
2024/08/07 17:18:32.942491 [101] cannot connect to [zabbix-proxy.pokus.cz:10051]: 139637872441088:error:0607B0C8:digital envelope routines:EVP_CipherInit_ex:disabled for FIPS:crypto/evp/evp_enc.c:227:
139637872441088:error:14202006:SSL routines:derive_secret_key_and_iv:EVP lib:ssl/tls13_enc.c:427:
2024/08/07 17:18:32.942532 [101] active check configuration update from host [xxx.pokus.cz] started to fail
The only workable solution is to use zabbix_agent1 and set: TLSCipherPSK13=TLS_AES_128_GCM_SHA256 For zabbix_agent2, the TLSCipherPSK13 option is not available. Expected: The server is behind Zabbix proxy 7.0.2 on Ubuntu 22.04. Other servers (Debian/Ubuntu) don't have any problems, and zabbix_agent2 works great. |
Comments |
Comment by Alexey Pustovalov [ 2024 Aug 08 ] |
Hello! Currently Zabbix does not support FIPS officially. Please follow and vote ZBXNEXT-6591 for feature request. Closing as duplicate. |