Could you please link to the documentation page that seems suspicious for you?

For instance, http://www.zabbix.com/documentation/2.0/manual/appendix/config/zabbix_proxy says the following about "Server" configuration parameter, which looks alright to me:

"IP address (or hostname) of Zabbix server. Active Proxy will get configuration data from the server. For a proxy in the passive mode this parameter will be ignored."

as i understood this, issue is about passive proxy working same as other daemons and only accepting connections from addresses, specified in the "Server" parameter.
i suppose documentation was only mentioned because it seemed strange to ignore that parameter.

Correct,
As stated in the description, I think the proxy should use the Server parameter in passive mode the same way the agent does , by filtering by IP the servers allowed to connect.
If this is already the case, the documentation should be fixed...

Thanks! Currently, passive proxy does not check server IP address. Reopening.

ZBXNEXT-866 asks to print out ip of the server we got the config from

ZBXNEXT-1486 is related.

Fixed in:

• 4.0.0alpha1 (trunk) r73528

I think this is the issue that CVE is about: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0327

Do you consider backporting this?

vso please consider using encryption, there is no vulnerability in that case. As far as I know it is not planned to backport because it requires database changes.

interestingly enough, neither this issue, nor the spec actually talk about limiting what active proxies can request from the server, but the changelog has :

A.F....PS. ZBXNEXT-4181 fixed Zabbix server to accept active Zabbix proxy requests only from allowed address if specified (Sasha, vso)

(1) server limiting active proxies is not mentioned in the upgrade notes.

this is important, as it will break things for people who use scripts on the server to send data for hosts, monitored by a proxy.

...but it looks like this is optional and documented in whatsnew instead.

the development is confusing and does not match the specification.

vso this was old specification, removed comment to avoid confussion, Won't Fix

<richlv> There's a specification link in the issue description. Is that the specification that was used?

What about the new active proxy limitation missing from the upgrade notes?

vso new active proxy limitation is optional, so it's missing from upgrade notes as nothing to worry about. No this specification was not used.

<richlv> Thank you for the answer. Previously the Server parameter was ignored, thus for somebody who had it specified an upgrade would change the behaviour. Is that correct?
Also, could it please be possible to modify the description to say that the linked specification was not used in the end?

vso I yes, please see following link:
https://www.zabbix.com/documentation/4.0/manual/introduction/whatsnew400#more_secure_connections_for_proxies
I have also deleted obsolete spec from issue description.

<richlv> Thank you for the description update.
I was also wrong the on the update topic, the field was not there in the older versions of Zabbix.

CLOSED