Linux

I have a couple of questions.

This suggests that this is checked only at the agent level.

What is checked only at the agent level?

I may be wrong, but for me

for any given PSK Identity defined on the Zabbix Server that there can be only one paired PSK value

and

ensure that there are no two PSKs with the same identity string but different values

express exactly the same idea.

Documentation has also warned you about possible consequences of such misconfiguration. And if you check server's log file there must be warnings about that too.

I wouldn't say that this is intentional, but this design flaw was realized too late during ZBXNEXT-1263 implementation. Probably it should be fixed some day...

Larry: This suggests that this is checked only at the agent level.
Vjaceslav: What is checked only at the agent level?

This verbiage from the documentation: "the server looks up the PSK identity and PSK value configured for that agent" The way this is worded it would suggest that it looks up the PSK Identity and PSK value on a host by host basis and would allow for the same PSK Identity and a different PSK value on different hosts."

express exactly the same idea.

While they express the same idea, they do so in a different way. My suggested language is to make it unmistakably clear that a PSK Identity must be globally unique. When new to this configuration I found the documentation ambiguous. Now that I'm familiar with how the process works the cautionary statement can now be understood. Initially that caution was read as reinforcing that if the PSK Identity matched and the PSK value didn't then it would not work. Of course, one already familiar with this detail no longer needs the documentation. Surely it's not too difficult to update the documentation?

Similarly, the PSK Troubleshooting (https://www.zabbix.com/documentation/3.0/manual/encryption/troubleshooting/psk_problems) documentation should be updated. The "Same PSK identity but different PSK values used by communicating components (example with OpenSSL)" section should explicitly state that this means that two or more hosts are using the same PSK Identity with different PSK values. As it's worded it's easy for the new person to read that as the Zabbix Agent is one component and the Zabbix Server/Proxy is the other component and that the PSK identity doesn't match on those 'communicating components'.

If agent uses encryption server cannot tell which agent it is talking to before decrypting. So it takes PSK from the global PSK storage based on PSK identity sent by agent. But after decryption server will know which agent it is and verifies that it used PSK identity it was supposed to use. Agent cannot just use any PSK server knows about.

should explicitly state that this means that two or more hosts are using the same PSK Identity with different PSK values

I disagree, this is not the only scenario leading to such error messages. For example, user can make a mistake and configure one PSK value in the frontend and another one on the agent side.

Dear martins-v, do you think we can improve documentation somehow? If yes, let's create a separate ZBX for that, because this ZBXNEXT should stay as a request to improve design of Zabbix.

Documentation updated:

Encryption -> 2 Using pre-shared keys in:

• 3.0
• 4.0
• 4.4
• 5.0