en	# 17 Encryption
zh-cn	# 17. 加密

en	#### Overview Zabbix supports encrypted communications between Zabbix components using Transport Layer Security (TLS) protocol v.1.2 and 1.3 (depending on the crypto library). Certificate-based and pre-shared key-based encryption is supported. Encryption can be configured for connections: - Between Zabbix server, Zabbix proxy, Zabbix agent, Zabbix web service, zabbix\_sender and zabbix\_get utilities - To Zabbix database [from Zabbix frontend and server/proxy](/manual/appendix/install/db_encrypt) - Between Zabbix frontend and Zabbix server Encryption is optional and configurable for individual components: - Some proxies and agents can be configured to use certificate-based encryption with the server, while others can use pre-shared key-based encryption, and yet others continue with unencrypted communications (as before). - Server (proxy) can use different encryption configurations for different hosts. Zabbix daemon programs use one listening port for encrypted and unencrypted incoming connections. Adding an encryption does not require opening new ports on firewalls.
zh-cn	#### 概述 Zabbix支持使用TLS协议v.1.2和1.3(取决于加密库)在Zabbix组件之间进行加密通信。支持证书加密和预共享密钥加密。 可以为连接配置加密: - Zabbix server，Zabbix proxy，Zabbix agent，Zabbix \_sender和Zabbix \_get工具 - 到Zabbix数据库[从zabbix前端和server/proxy](/manual/appendix/install/db_encrypt) 加密是可选和可配置的单个组件: - 一些proxy和agent可以配置为使用服务器的基于证书的加密，而其他的可以使用基于预共享密钥的加密，而其他的则继续使用未加密的通信(与前面一样) - Server (proxy) 可以为不同的主机使用不同的加密配置。 Zabbix守护程序为传入的加密和非加密连接使用一个侦听端口。 添加加密并不需要在防火墙上打开新的端口。

en	#### Limitations - Private keys are stored in plain text in files readable by Zabbix components during startup. - Pre-shared keys are entered in Zabbix frontend and stored in Zabbix database in plain text. - Built-in encryption does not protect communications between the web server running Zabbix frontend and user web browser. - Currently each encrypted connection opens with a full TLS handshake, no session caching and tickets are implemented. - Adding encryption increases the time for item checks and actions, depending on network latency: - For example, if packet delay is 100ms then opening a TCP connection and sending unencrypted request takes around 200ms. With encryption about 1000 ms are added for establishing the TLS connection. - Timeouts may need to be increased, otherwise some items and actions running remote scripts on agents may work with unencrypted connections, but fail with timeout with encrypted. - Encryption is not supported by [network discovery](/manual/discovery/network_discovery). Zabbix agent checks performed by network discovery will be unencrypted and if Zabbix agent is configured to reject unencrypted connections such checks will not succeed.
zh-cn	#### 限制因素 - 私钥以纯文本形式存储在Zabbix组件启动时可读的文件中 - 预共享密钥在Zabbix前端输入，并以明文形式存储在Zabbix数据库中 - 内置加密不能保护通信: - 运行Zabbix前端的web服务器和用户web浏览器之间 - Zabbix前端和Zabbix server之间 - 目前，每个加密连接都使用完整的TLS握手打开，没有实现会话缓存和票据 - 根据网络延迟，添加加密会增加监控项检查和操作的时间: - 例如，如果包延迟100ms，那么打开TCP连接并发送未加密的请求大约需要200ms。 在建立TLS连接时，增加约1000毫秒的加密; - 超时可能需要增加，否则在代理上运行远程脚本的某些监控项和操作可能会在未加密的连接中工作，但在加密的连接中超时则会失败。 - 不支持加密 [网络设备自动发现](/manual/discovery/network_discovery)。由网络发现执行的Zabbix agent 检查将不加密，如果Zabbix agent被配置为拒绝未加密的连接，这样的检查将不会成功。

en	#### Compiling Zabbix with encryption support To support encryption Zabbix must be compiled and linked with one of the supported crypto libraries: - GnuTLS - from version 3.1.18 - OpenSSL - versions 1.0.1, 1.0.2, 1.1.0, 1.1.1, 3.0.x - LibreSSL - tested with versions 2.7.4, 2.8.2: - LibreSSL 2.6.x is not supported - LibreSSL is supported as a compatible replacement of OpenSSL; the new `tls_*()` LibreSSL-specific API functions are not used. Zabbix components compiled with LibreSSL will not be able to use PSK, only certificates can be used. :::notetip You can find out more about setting up SSL for Zabbix frontend by referring to these [best practices](/manual/best_practices/security/cryptography#setting-up-ssl-for-zabbix-frontend). ::: The library is selected by specifying the respective option to "configure" script: - `--with-gnutls[=DIR]` - `--with-openssl[=DIR]` (also used for LibreSSL) For example, to configure the sources for server and agent with *OpenSSL* you may use something like: ./configure --enable-server --enable-agent --with-mysql --enable-ipv6 --with-net-snmp --with-libcurl --with-libxml2 --with-openssl Different Zabbix components may be compiled with different crypto libraries (e.g. a server with *OpenSSL*, an agent with *GnuTLS*). ::: noteimportant If you plan to use pre-shared keys (PSK), consider using *GnuTLS* or *OpenSSL 1.1.0* (or newer) libraries in Zabbix components using PSKs. *GnuTLS* and *OpenSSL 1.1.0* libraries support PSK ciphersuites with [Perfect Forward Secrecy](https://en.wikipedia.org/wiki/Forward_secrecy#Perfect_forward_secrecy_.28PFS.29). Older versions of the *OpenSSL* library (1.0.1, 1.0.2c) also support PSKs, but available PSK ciphersuites do not provide Perfect Forward Secrecy. :::
zh-cn	#### 编译支持加密的Zabbix 为了支持加密，Zabbix必须编译并链接到受支持的加密库之一: - GnuTLS - 从版本3.1.18 - OpenSSL - 版本1.0.1, 1.0.2, 1.1.0, 1.1.1,3.0.x - LibreSSL - 测试版本 2.7.4, 2.8.2: - LibreSSL 2.6.x 是不支持的 - LibreSSL支持作为OpenSSL的兼容替代品； 新的' tls_*() ' libressl特定的API函数没有被使用。使用LibreSSL编译的Zabbix组件将不能使用PSK，只能使用证书。 通过指定相应的选项来“configure”脚本来选择库: - `--with-gnutls[=DIR]` - `--with-openssl[=DIR]` (也用于LibreSSL) 例如，要用*OpenSSL*配置server和agent的源文件，你可以使用如下方法: ./configure --enable-server --enable-agent --with-mysql --enable-ipv6 --with-net-snmp --with-libcurl --with-libxml2 --with-openssl 不同的Zabbix组件可以使用不同的加密库进行编译 (例如，服务器上有*OpenSSL*，代理上有*GnuTLS*)。 ::: noteimportant 如果您计划使用预共享密钥(PSK)，请考虑在使用PSK的Zabbix组件中使用*GnuTLS*或*OpenSSL 1.1.0*(或更新)库。 *GnuTLS*和*OpenSSL 1.1.0*库 支持PSK密码套件 [向前兼容密码](https://en.wikipedia.org/wiki/Forward_secrecy#Perfect_forward_secrecy_.28PFS.29).*OpenSSL*库的旧版本(1.0.1,1.0.2c)也支持PSK，但可用的PSK密码套件不支持向前兼容密码。 :::

en	#### Connection encryption management Connections in Zabbix can use: - no encryption (default) - [RSA certificate-based encryption](/manual/encryption/using_certificates) - [PSK-based encryption](/manual/encryption/using_pre_shared_keys) There are two important parameters used to specify encryption between Zabbix components: - TLSConnect - specifies what encryption to use for outgoing connections (unencrypted, PSK or certificate) - TLSAccept - specifies what types of connections are allowed for incoming connections (unencrypted, PSK or certificate). One or more values can be specified. `TLSConnect` is used in the configuration files for Zabbix proxy (in active mode, specifies only connections to server) and Zabbix agent (for active checks). In Zabbix frontend the TLSConnect equivalent is the *Connections to host* field in *Data collection → Hosts → <some host> → Encryption* tab and the *Connections to proxy* field in *Administration → Proxies → <some proxy> → Encryption* tab. If the configured encryption type for connection fails, no other encryption types will be tried. `TLSAccept` is used in the configuration files for Zabbix proxy (in passive mode, specifies only connections from server) and Zabbix agent (for passive checks). In Zabbix frontend the TLSAccept equivalent is the *Connections from host* field in *Data collection → Hosts → <some host> → Encryption* tab and the *Connections from proxy* field in *Administration → Proxies → <some proxy> → Encryption* tab. Normally you configure only one type of encryption for incoming connections. But you may want to switch the encryption type, e.g. from unencrypted to certificate-based with minimum downtime and rollback possibility. To achieve this: - Set `TLSAccept=unencrypted,cert` in the agent configuration file and restart Zabbix agent - Test connection with zabbix\_get to the agent using certificate. If it works, you can reconfigure encryption for that agent in Zabbix frontend in the *Data collection → Hosts → <some host> → Encryption* tab by setting *Connections to host* to "Certificate". - When server configuration cache gets updated (and proxy configuration is updated if the host is monitored by proxy) then connections to that agent will be encrypted - If everything works as expected you can set `TLSAccept=cert` in the agent configuration file and restart Zabbix agent. Now the agent will be accepting only encrypted certificate-based connections. Unencrypted and PSK-based connections will be rejected. In a similar way it works on server and proxy. If in Zabbix frontend in host configuration *Connections from host* is set to "Certificate" then only certificate-based encrypted connections will be accepted from the agent (active checks) and zabbix\_sender (trapper items). Most likely you will configure incoming and outgoing connections to use the same encryption type or no encryption at all. But technically it is possible to configure it asymmetrically, e.g. certificate-based encryption for incoming and PSK-based for outgoing connections. Encryption configuration for each host is displayed in the Zabbix frontend, in *Data collection → Hosts* in the *Agent encryption* column. For example: |Example|Connections to host|Allowed connections from host|Rejected connections from host| |-------|-------------------|-----------------------------|------------------------------| |![none\_none.png](../../assets/en/manual/encryption/none_none.png)|Unencrypted|Unencrypted|Encrypted, certificate and PSK-based encrypted| |![cert\_cert.png](../../assets/en/manual/encryption/cert_cert.png)|Encrypted, certificate-based|Encrypted, certificate-based|Unencrypted and PSK-based encrypted| |![psk\_psk.png](../../assets/en/manual/encryption/psk_psk.png)|Encrypted, PSK-based|Encrypted, PSK-based|Unencrypted and certificate-based encrypted| |![psk\_none\_psk.png](../../assets/en/manual/encryption/psk_none_psk.png)|Encrypted, PSK-based|Unencrypted and PSK-based encrypted|Certificate-based encrypted| |![cert\_all.png](../../assets/en/manual/encryption/cert_all.png)|Encrypted, certificate-based|Unencrypted, PSK or certificate-based encrypted|\-| ::: noteimportant Connections are unencrypted by default. Encryption must be configured for each host and proxy individually. :::
zh-cn	#### 连接加密管理 Zabbix中的连接可以使用： - 不加密 (默认) - [基于RSA证书的加密](/manual/encryption/using_certificates) - [基于PSK基础加密](/manual/encryption/using_pre_shared_keys) 有两个重要的参数用于指定之间的加密Zabbix组件: - TLSConnect -指定对传出连接使用何种加密(未加密、PSK或证书) - TLSAccept - 指定允许传入连接的类型(未加密的，PSK或证书)。 可以指定一个或多个值。 `TLSConnect` 在Zabbix proxy(在主动模式下，仅指定到server的连接)和Zabbix agent(在主动检查中)的配置文件中使用。在Zabbix前端TLSConnect等效的是*Data collection → Hosts → <some host> → Encryption* tab and the *Connections to proxy* 标签中的*连接到主机*字段和*Administration → Proxies → <some proxy> → Encryption*标签中的*连接到proxy*字段。如果为连接配置的加密类型失败，则不会尝试其他加密类型。 `TLSAccept` 在Zabbix proxy(被动模式，仅指定来自server的连接)和Zabbix agent(被动检查)的配置文件中使用。在Zabbix前端TLSAccept等价的是*Data collection → Hosts → <some host> → Encryption*标签中的*主机连接*字段和*Administration → Proxies → <some proxy> → Encryption*标签中的*proxy连接*字段。 通常您只为传入加密配置一种类型的加密。 但您可能希望切换加密类型，例如，从未加密切换到基于证书的加密，并尽可能减少停机时间和回滚可能性。 为实现这一目标: - 设置 `TLSAccept=unencrypted,cert` 在agent配置文件中设置，重启Zabbix agent - 使用证书测试zabbix\_get到agent的连接。如果它能工作，你可以在Zabbix前端的*Data collection → Hosts → <some host> → Encryption*选项卡中通过将*Connections to host*设置为“Certificate”来重新配置该agent的加密。 - 当server配置缓存被更新时(如果主机被proxy 监控，则proxy配置被更新)，那么到该proxy的连接将被加密 - 如果一切正常，您可以在agent配置文件中设置' TLSAccept=cert '，并重启Zabbix agent。现在agent将只接受加密的基于证书的连接。 未加密的和基于psk的连接将被拒绝。 以类似的方式，它在server和proxy上工作。 如果在Zabbix前端主机配置*来自主机的连接*设置为“证书”，那么只有基于证书的加密连接将被接受从agent(主动检查)和Zabbix\_sender(trapper监控项)。 最可能的情况是将传入和传出连接配置为使用相同的加密类型或完全不加密。 但在技术上，可以不对称地配置它，例如，对传入连接进行基于证书的加密，对传出连接进行基于psk的加密。 Zabbix前端“*Agent加密*”列的“*Data collection → Hosts*”中显示各主机的加密配置信息。 例如: |例子|连接到主机|允许连接的主机|拒绝连接的主机| |-------|-------------------|-----------------------------|------------------------------| |![none\_none.png](../../assets/en/manual/encryption/none_none.png)|非加密的|非加密的|加密，证书和psk加密| |![cert\_cert.png](../../assets/en/manual/encryption/cert_cert.png)|加密的,基于证书|加密的, 基于证书|加密的基于PSK| |![psk\_psk.png](../../assets/en/manual/encryption/psk_psk.png)|加密的, 基于PSK|加密的, 基于PSK|非加密的基于证书加密的| |![psk\_none\_psk.png](../../assets/en/manual/encryption/psk_none_psk.png)|加密的, 基于PSK|非加密和基于PSK加密|基于证书加密| |![cert\_all.png](../../assets/en/manual/encryption/cert_all.png)|加密, 证书加密|未加密, PSK或者or基于证书加密|\-| :: noteimportant 默认情况下，连接是不加密的。如果使用加密那么必须分别为每个主机和proxy配置加密。 :::

en	#### zabbix\_get and zabbix\_sender with encryption See [zabbix\_get](/manpages/zabbix_get) and [zabbix\_sender](/manpages/zabbix_sender) manpages for using them with encryption.
zh-cn	#### zabbix\_get and zabbix\_sender与加密 请参阅[zabbix\_get](/manpages/zabbix_get)和[zabbix\_sender](/manpages/zabbix_sender) 操作说明使用加密。

en	#### Ciphersuites Ciphersuites by default are configured internally during Zabbix startup. Also user-configured ciphersuites are supported for GnuTLS and OpenSSL. Users may [configure](#user-configured_ciphersuites) ciphersuites according to their security policies. Using this feature is optional (built-in default ciphersuites still work). For crypto libraries compiled with default settings Zabbix built-in rules typically result in the following ciphersuites (in order from higher to lower priority): |Library|Certificate ciphersuites|PSK ciphersuites| |-------|------------------------|----------------| |*GnuTLS 3.1.18*|TLS\_ECDHE\_RSA\_AES\_128\_GCM\_SHA256<br>TLS\_ECDHE\_RSA\_AES\_128\_CBC\_SHA256<br>TLS\_ECDHE\_RSA\_AES\_128\_CBC\_SHA1<br>TLS\_RSA\_AES\_128\_GCM\_SHA256<br>TLS\_RSA\_AES\_128\_CBC\_SHA256<br>TLS\_RSA\_AES\_128\_CBC\_SHA1|TLS\_ECDHE\_PSK\_AES\_128\_CBC\_SHA256<br>TLS\_ECDHE\_PSK\_AES\_128\_CBC\_SHA1<br>TLS\_PSK\_AES\_128\_GCM\_SHA256<br>TLS\_PSK\_AES\_128\_CBC\_SHA256<br>TLS\_PSK\_AES\_128\_CBC\_SHA1| |*OpenSSL 1.0.2c*|ECDHE-RSA-AES128-GCM-SHA256<br>ECDHE-RSA-AES128-SHA256<br>ECDHE-RSA-AES128-SHA<br>AES128-GCM-SHA256<br>AES128-SHA256<br>AES128-SHA|PSK-AES128-CBC-SHA| |*OpenSSL 1.1.0*|ECDHE-RSA-AES128-GCM-SHA256<br>ECDHE-RSA-AES128-SHA256<br>ECDHE-RSA-AES128-SHA<br>AES128-GCM-SHA256<br>AES128-CCM8<br>AES128-CCM<br>AES128-SHA256<br>AES128-SHA<br>|ECDHE-PSK-AES128-CBC-SHA256<br>ECDHE-PSK-AES128-CBC-SHA<br>PSK-AES128-GCM-SHA256<br>PSK-AES128-CCM8<br>PSK-AES128-CCM<br>PSK-AES128-CBC-SHA256<br>PSK-AES128-CBC-SHA| |*OpenSSL 1.1.1d*|TLS\_AES\_256\_GCM\_SHA384<br>TLS\_CHACHA20\_POLY1305\_SHA256<br>TLS\_AES\_128\_GCM\_SHA256<br>ECDHE-RSA-AES128-GCM-SHA256<br>ECDHE-RSA-AES128-SHA256<br>ECDHE-RSA-AES128-SHA<br>AES128-GCM-SHA256<br>AES128-CCM8<br>AES128-CCM<br>AES128-SHA256<br>AES128-SHA|TLS\_CHACHA20\_POLY1305\_SHA256<br>TLS\_AES\_128\_GCM\_SHA256<br>ECDHE-PSK-AES128-CBC-SHA256<br>ECDHE-PSK-AES128-CBC-SHA<br>PSK-AES128-GCM-SHA256<br>PSK-AES128-CCM8<br>PSK-AES128-CCM<br>PSK-AES128-CBC-SHA256<br>PSK-AES128-CBC-SHA|
zh-cn	#### 密码套件 在 Zabbix 启动期间，默认情况下内部配置密码套件。 此外，用户配置的密码套件支持 GnuTLS 和 OpenSSL。用户可以根据其安全策略[配置](#user-configured_ciphersuites)密码套件。使用此功能是可选的（内置的默认密码套件仍然有效）。 对于使用默认设置编译的加密库，Zabbix 内置规则通常会生成以下密码套件（按优先级从高到低排列）： |Library|Certificate ciphersuites|PSK ciphersuites| |-------|------------------------|----------------| |*GnuTLS 3.1.18*|TLS\_ECDHE\_RSA\_AES\_128\_GCM\_SHA256<br>TLS\_ECDHE\_RSA\_AES\_128\_CBC\_SHA256<br>TLS\_ECDHE\_RSA\_AES\_128\_CBC\_SHA1<br>TLS\_RSA\_AES\_128\_GCM\_SHA256<br>TLS\_RSA\_AES\_128\_CBC\_SHA256<br>TLS\_RSA\_AES\_128\_CBC\_SHA1|TLS\_ECDHE\_PSK\_AES\_128\_CBC\_SHA256<br>TLS\_ECDHE\_PSK\_AES\_128\_CBC\_SHA1<br>TLS\_PSK\_AES\_128\_GCM\_SHA256<br>TLS\_PSK\_AES\_128\_CBC\_SHA256<br>TLS\_PSK\_AES\_128\_CBC\_SHA1| |*OpenSSL 1.0.2c*|ECDHE-RSA-AES128-GCM-SHA256<br>ECDHE-RSA-AES128-SHA256<br>ECDHE-RSA-AES128-SHA<br>AES128-GCM-SHA256<br>AES128-SHA256<br>AES128-SHA|PSK-AES128-CBC-SHA| |*OpenSSL 1.1.0*|ECDHE-RSA-AES128-GCM-SHA256<br>ECDHE-RSA-AES128-SHA256<br>ECDHE-RSA-AES128-SHA<br>AES128-GCM-SHA256<br>AES128-CCM8<br>AES128-CCM<br>AES128-SHA256<br>AES128-SHA<br>|ECDHE-PSK-AES128-CBC-SHA256<br>ECDHE-PSK-AES128-CBC-SHA<br>PSK-AES128-GCM-SHA256<br>PSK-AES128-CCM8<br>PSK-AES128-CCM<br>PSK-AES128-CBC-SHA256<br>PSK-AES128-CBC-SHA| |*OpenSSL 1.1.1d*|TLS\_AES\_256\_GCM\_SHA384<br>TLS\_CHACHA20\_POLY1305\_SHA256<br>TLS\_AES\_128\_GCM\_SHA256<br>ECDHE-RSA-AES128-GCM-SHA256<br>ECDHE-RSA-AES128-SHA256<br>ECDHE-RSA-AES128-SHA<br>AES128-GCM-SHA256<br>AES128-CCM8<br>AES128-CCM<br>AES128-SHA256<br>AES128-SHA|TLS\_CHACHA20\_POLY1305\_SHA256<br>TLS\_AES\_128\_GCM\_SHA256<br>ECDHE-PSK-AES128-CBC-SHA256<br>ECDHE-PSK-AES128-CBC-SHA<br>PSK-AES128-GCM-SHA256<br>PSK-AES128-CCM8<br>PSK-AES128-CCM<br>PSK-AES128-CBC-SHA256<br>PSK-AES128-CBC-SHA|

en	#### User-configured ciphersuites The built-in ciphersuite selection criteria can be overridden with user-configured ciphersuites. ::: noteimportant User-configured ciphersuites is a feature intended for advanced users who understand TLS ciphersuites, their security and consequences of mistakes, and who are comfortable with TLS troubleshooting. ::: The built-in ciphersuite selection criteria can be overridden using the following parameters: |Override scope|Parameter|Value|Description| |--|--|------|------| |Ciphersuite selection for certificates|TLSCipherCert13|Valid OpenSSL 1.1.1 [cipher strings](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html) for TLS 1.3 protocol (their values are passed to the OpenSSL function `SSL_CTX_set_ciphersuites()`).|Certificate-based ciphersuite selection criteria for TLS 1.3<br><br>Only OpenSSL 1.1.1 or newer.| |^|TLSCipherCert|Valid OpenSSL [cipher strings](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html) for TLS 1.2 or valid GnuTLS [priority strings](https://gnutls.org/manual/html_node/Priority-Strings.html). Their values are passed to the `SSL_CTX_set_cipher_list()` or `gnutls_priority_init()` functions, respectively.|Certificate-based ciphersuite selection criteria for TLS 1.2/1.3 (GnuTLS), TLS 1.2 (OpenSSL)| |Ciphersuite selection for PSK|TLSCipherPSK13|Valid OpenSSL 1.1.1 [cipher strings](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html) for TLS 1.3 protocol (their values are passed to the OpenSSL function `SSL_CTX_set_ciphersuites()`).|PSK-based ciphersuite selection criteria for TLS 1.3<br><br>Only OpenSSL 1.1.1 or newer.| |^|TLSCipherPSK|Valid OpenSSL [cipher strings](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html) for TLS 1.2 or valid GnuTLS [priority strings](https://gnutls.org/manual/html_node/Priority-Strings.html). Their values are passed to the `SSL_CTX_set_cipher_list()` or `gnutls_priority_init()` functions, respectively.|PSK-based ciphersuite selection criteria for TLS 1.2/1.3 (GnuTLS), TLS 1.2 (OpenSSL)| |Combined ciphersuite list for certificate and PSK|TLSCipherAll13|Valid OpenSSL 1.1.1 [cipher strings](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html) for TLS 1.3 protocol (their values are passed to the OpenSSL function `SSL_CTX_set_ciphersuites()`).|Ciphersuite selection criteria for TLS 1.3<br><br>Only OpenSSL 1.1.1 or newer.| |^|TLSCipherAll|Valid OpenSSL [cipher strings](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html) for TLS 1.2 or valid GnuTLS [priority strings](https://gnutls.org/manual/html_node/Priority-Strings.html). Their values are passed to the `SSL_CTX_set_cipher_list()` or `gnutls_priority_init()` functions, respectively.|Ciphersuite selection criteria for TLS 1.2/1.3 (GnuTLS), TLS 1.2 (OpenSSL)| To override the ciphersuite selection in [zabbix\_get](/manpages/zabbix_get) and [zabbix\_sender](/manpages/zabbix_sender) utilities - use the command-line parameters: - `--tls-cipher13` - `--tls-cipher` The new parameters are optional. If a parameter is not specified, the internal default value is used. If a parameter is defined it cannot be empty. If the setting of a TLSCipher\* value in the crypto library fails then the server, proxy or agent will not start and an error is logged. It is important to understand when each parameter is applicable.
zh-cn	#### 用户配置密码套件 内置的密码套件选择标准可以被用户配置的密码套件覆盖。 ::: noteimportant 用户配置的密码套件是针对了解TLS密码套件、其安全性和错误后果以及熟悉TLS故障排除的高级用户的特性。 ::: 内置的密码套件选择标准可以使用以下参数覆盖: |覆盖范围|参数|值|描述| |--------------|---------|-----|-----------| |证书的密码套件选择|TLSCipherCert13|有效 OpenSSL 1.1.1 [cipher strings](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html) 对于TLS 1.3协议(它们的值被传递到OpenSSL函数SSL\_CTX\_set\_ciphersuites())。|TLS 1.3的基于证书的加密套件选择标准<br><br>仅支持OpenSSL 1.1.1及以上版本。| |^|TLSCipherCert|针对TLS 1.2的有效OpenSSL[密码字符串](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html) 或有效的GnuTLS[优先级字符串](https://gnutls.org/manual/html_node/Priority-Strings.html)。它们的值分别传递给SSL\_CTX\_set\_cipher\_list()或gnutls\_priority\_init()函数。|针对TLS 1.2/1.3 (GnuTLS)、TLS 1.2 (OpenSSL)的基于证书的密码套件选择标准。| |Ciphersuite selection for PSK|TLSCipherPSK13|有效的OpenSSL 1.1.1[密码字符串](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html) 对于TLS 1.3协议(它们的值被传递到OpenSSL函数SSL\_CTX\_set\_ciphersuites())。|基于psk的TLS 1.3加密套件选择标准<br><br>仅支持OpenSSL 1.1.1及以上版本。| |^|TLSCipherPSK|对于TLS 1.2有效的OpenSSL[密码字符串](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html)或有效的GnuTLS[优先级字符串](https://gnutls.org/manual/html_node/Priority-Strings.html)。它们的值分别传递给SSL\_CTX\_set\_cipher\_list()或gnutls\_priority\_init()函数。|基于psk的TLS 1.2/1.3 (GnuTLS)、TLS 1.2 (OpenSSL)加密套件选择标准。| |Combined ciphersuite list for certificate and PSK|TLSCipherAll13|TLS 1.3协议的有效的OpenSSL 1.1.1[密码字符串](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html)(它们的值被传递到OpenSSL函数SSL\_CTX\_set\_ciphersuites())。|TLS 1.3<br><br>仅支持OpenSSL 1.1.1及以上版本。| |^|TLSCipherAll|对于TLS 1.2有效的OpenSSL[密码字符串](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html)或有效的GnuTLS[优先级字符串](https://gnutls.org/manual/html_node/Priority-Strings.html)。它们的值分别传递给SSL\_CTX\_set\_cipher\_list()或gnutls\_priority\_init()函数。|针对TLS 1.2/1.3 (GnuTLS)、TLS 1.2 (OpenSSL)的加密套件选择标准.| 在[zabbix\_get](/manpages/zabbix_get)和[zabbix\_sender](/manpages/zabbix_sender)工具中覆盖密码套件选择 - 使用命令行参数: - `--tls-cipher13` - `--tls-cipher` 新参数为可选参数。 如果没有指定参数，则使用内部的默认值。 如果参数已定义，则它不能为空。 如果加密库中的tlsciphher \*值设置失败，则server、proxy或agent将无法启动，并记录一个错误。 理解每个参数何时适用是很重要的。

en	##### Outgoing connections The simplest case is outgoing connections: - For outgoing connections with certificate - use TLSCipherCert13 or TLSCipherCert - For outgoing connections with PSK - use TLSCipherPSK13 or TLSCipherPSK - In case of zabbix\_get and zabbix\_sender utilities the command-line parameters `--tls-cipher13` or `--tls-cipher` can be used (encryption is unambiguously specified with a `--tls-connect` parameter)
zh-cn	##### 外部连接 简单例子外部连接: - 对于使用证书的外发连接-使用TLSCipherCert13或TLSCipherCert - 对于PSK外发连接，使用TLSCipherPSK13和TLSCipherPSK - 在zabbix\_get和zabbix\_sender实用程序中，可以使用命令行参数'——tls-cipher13 '和'——tls-cipher '(加密用'——tls-connect '参数明确指定)

en	##### Incoming connections It is a bit more complicated with incoming connections because rules are specific for components and configuration. For Zabbix **agent**: |Agent connection setup|Cipher configuration| |----------------------|--------------------| |TLSConnect=cert|TLSCipherCert, TLSCipherCert13| |TLSConnect=psk|TLSCipherPSK, TLSCipherPSK13| |TLSAccept=cert|TLSCipherCert, TLSCipherCert13| |TLSAccept=psk|TLSCipherPSK, TLSCipherPSK13| |TLSAccept=cert,psk|TLSCipherAll, TLSCipherAll13| For Zabbix **server** and **proxy**: |Connection setup|Cipher configuration| |----------------|--------------------| |Outgoing connections using PSK|TLSCipherPSK, TLSCipherPSK13| |Incoming connections using certificates|TLSCipherAll, TLSCipherAll13| |Incoming connections using PSK if server has no certificate|TLSCipherPSK, TLSCipherPSK13| |Incoming connections using PSK if server has certificate|TLSCipherAll, TLSCipherAll13| Some pattern can be seen in the two tables above: - TLSCipherAll and TLSCipherAll13 can be specified only if a combined list of certificate- **and** PSK-based ciphersuites is used. There are two cases when it takes place: server (proxy) with a configured certificate (PSK ciphersuites are always configured on server, proxy if crypto library supports PSK), agent configured to accept both certificate- and PSK-based incoming connections - in other cases TLSCipherCert\* and/or TLSCipherPSK\* are sufficient The following tables show the `TLSCipher*` built-in default values. They could be a good starting point for your own custom values. |Parameter|GnuTLS 3.6.12| |--|--------| |TLSCipherCert|NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509| |TLSCipherPSK|NONE:+VERS-TLS1.2:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL| |TLSCipherAll|NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509| |Parameter|OpenSSL 1.1.1d ^**1**^| |--|--------| |TLSCipherCert13|<| |TLSCipherCert|EECDH+aRSA+AES128:RSA+aRSA+AES128| |TLSCipherPSK13|TLS\_CHACHA20\_POLY1305\_SHA256:TLS\_AES\_128\_GCM\_SHA256| |TLSCipherPSK|kECDHEPSK+AES128:kPSK+AES128| |TLSCipherAll13|<| |TLSCipherAll|EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128| ^**1**^ Default values are different for older OpenSSL versions (1.0.1, 1.0.2, 1.1.0), for LibreSSL and if OpenSSL is compiled without PSK support. **Examples of user-configured ciphersuites** See below the following examples of user-configured ciphersuites: - [Testing cipher strings and allowing only PFS ciphersuites](#testing_cipher_strings_and_allowing_only_pfs_ciphersuites) - [Switching from AES128 to AES256](#switching_from_aes128_to_aes256)
zh-cn	##### 传入连接 传入连接有点复杂，因为规则是 特定于组件和配置。 对 Zabbix **agent**: |Agent 连接步骤|Cipher 配置| |----------------------|--------------------| |TLSConnect=cert|TLSCipherCert, TLSCipherCert13| |TLSConnect=psk|TLSCipherPSK, TLSCipherPSK13| |TLSAccept=cert|TLSCipherCert, TLSCipherCert13| |TLSAccept=psk|TLSCipherPSK, TLSCipherPSK13| |TLSAccept=cert,psk|TLSCipherAll, TLSCipherAll13| 对 Zabbix **server** and **proxy**: |连接|Cipher 配置| |----------------|--------------------| |Outgoing connections using PSK|TLSCipherPSK, TLSCipherPSK13| |Incoming connections using certificates|TLSCipherAll, TLSCipherAll13| |Incoming connections using PSK if server has no certificate|TLSCipherPSK, TLSCipherPSK13| |Incoming connections using PSK if server has certificate|TLSCipherAll, TLSCipherAll13| 从上面的两个表中可以看出一些模式： -只有当组合 使用基于证书的**和**PSK密码套件的列表。那里 发生时有两种情况：Server（Proxy）配置了 证书（PSK密码套件总是在Server、Proxy服务器上配置 如果加密库支持PSK），则代理配置为接受两者 基于证书和PSK的传入连接 -在其他情况下，TLSCipherCert和/或TLSCipherPSK就足够了 下表显示了“TLSCipher*”内置默认值。他们 可能是您自己的自定义值的一个很好的起点。 |参数|GnuTLS 3.6.12| |--|--------| |TLSCipherCert|NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509| |TLSCipherPSK|NONE:+VERS-TLS1.2:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL| |TLSCipherAll|NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509| |参数|OpenSSL 1.1.1d ^**1**^| |--|--------| |TLSCipherCert13|<| |TLSCipherCert|EECDH+aRSA+AES128:RSA+aRSA+AES128| |TLSCipherPSK13|TLS\_CHACHA20\_POLY1305\_SHA256:TLS\_AES\_128\_GCM\_SHA256| |TLSCipherPSK|kECDHEPSK+AES128:kPSK+AES128| |TLSCipherAll13|<| |TLSCipherAll|EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128| ^**1**^ 旧版本的OpenSSL（1.0.1,1.0.2、1.1.0）、LibreSSL以及在不支持PSK的情况下编译的OpenSSL的默认值不同。 **用户配置的密码套件示例** 请参阅以下用户配置密码套件的示例： - [测试密码串并只允许PFS密码套件](#testing_cipher_strings_and_allowing_only_pfs_ciphersuites) - [从AES128切换到AES256](#switching_from_aes128_to_aes256)

en	##### Testing cipher strings and allowing only PFS ciphersuites To see which ciphersuites have been selected you need to set 'DebugLevel=4' in the configuration file, or use the `-vv` option for zabbix\_sender. Some experimenting with `TLSCipher*` parameters might be necessary before you get the desired ciphersuites. It is inconvenient to restart Zabbix server, proxy or agent multiple times just to tweak `TLSCipher*` parameters. More convenient options are using zabbix\_sender or the `openssl` command. Let's show both. **1.** Using zabbix\_sender. Let's make a test configuration file, for example `/home/zabbix/test.conf`, with the syntax of a `zabbix_agentd.conf` file: Hostname=nonexisting ServerActive=nonexisting TLSConnect=cert TLSCAFile=/home/zabbix/ca.crt TLSCertFile=/home/zabbix/agent.crt TLSKeyFile=/home/zabbix/agent.key TLSPSKIdentity=nonexisting TLSPSKFile=/home/zabbix/agent.psk You need valid CA and agent certificates and PSK for this example. Adjust certificate and PSK file paths and names for your environment. If you are not using certificates, but only PSK, you can make a simpler test file: Hostname=nonexisting ServerActive=nonexisting TLSConnect=psk TLSPSKIdentity=nonexisting TLSPSKFile=/home/zabbix/agentd.psk The selected ciphersuites can be seen by running zabbix\_sender (example compiled with OpenSSL 1.1.d): $ zabbix_sender -vv -c /home/zabbix/test.conf -k nonexisting_item -o 1 2>&1 | grep ciphersuites zabbix_sender [41271]: DEBUG: zbx_tls_init_child() certificate ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES128-GCM-SHA256 AES128-CCM8 AES128-CCM AES128-SHA256 AES128-SHA zabbix_sender [41271]: DEBUG: zbx_tls_init_child() PSK ciphersuites: TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA PSK-AES128-GCM-SHA256 PSK-AES128-CCM8 PSK-AES128-CCM PSK-AES128-CBC-SHA256 PSK-AES128-CBC-SHA zabbix_sender [41271]: DEBUG: zbx_tls_init_child() certificate and PSK ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES128-GCM-SHA256 AES128-CCM8 AES128-CCM AES128-SHA256 AES128-SHA ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA PSK-AES128-GCM-SHA256 PSK-AES128-CCM8 PSK-AES128-CCM PSK-AES128-CBC-SHA256 PSK-AES128-CBC-SHA Here you see the ciphersuites selected by default. These default values are chosen to ensure interoperability with Zabbix agents running on systems with older OpenSSL versions (from 1.0.1). With newer systems you can choose to tighten security by allowing only a few ciphersuites, e.g. only ciphersuites with PFS (Perfect Forward Secrecy). Let's try to allow only ciphersuites with PFS using `TLSCipher*` parameters. ::: noteimportant The result will not be interoperable with systems using OpenSSL 1.0.1 and 1.0.2, if PSK is used. Certificate-based encryption should work. ::: Add two lines to the `test.conf` configuration file: TLSCipherCert=EECDH+aRSA+AES128 TLSCipherPSK=kECDHEPSK+AES128 and test again: $ zabbix_sender -vv -c /home/zabbix/test.conf -k nonexisting_item -o 1 2>&1 | grep ciphersuites zabbix_sender [42892]: DEBUG: zbx_tls_init_child() certificate ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA zabbix_sender [42892]: DEBUG: zbx_tls_init_child() PSK ciphersuites: TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA zabbix_sender [42892]: DEBUG: zbx_tls_init_child() certificate and PSK ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES128-GCM-SHA256 AES128-CCM8 AES128-CCM AES128-SHA256 AES128-SHA ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA PSK-AES128-GCM-SHA256 PSK-AES128-CCM8 PSK-AES128-CCM PSK-AES128-CBC-SHA256 PSK-AES128-CBC-SHA The "certificate ciphersuites" and "PSK ciphersuites" lists have changed - they are shorter than before, only containing TLS 1.3 ciphersuites and TLS 1.2 ECDHE-\* ciphersuites as expected. **2.** TLSCipherAll and TLSCipherAll13 cannot be tested with zabbix\_sender; they do not affect "certificate and PSK ciphersuites" value shown in the example above. To tweak TLSCipherAll and TLSCipherAll13 you need to experiment with the agent, proxy or server. So, to allow only PFS ciphersuites you may need to add up to three parameters TLSCipherCert=EECDH+aRSA+AES128 TLSCipherPSK=kECDHEPSK+AES128 TLSCipherAll=EECDH+aRSA+AES128:kECDHEPSK+AES128 to zabbix\_agentd.conf, zabbix\_proxy.conf and zabbix\_server\_conf if each of them has a configured certificate and agent has also PSK. If your Zabbix environment uses only PSK-based encryption and no certificates, then only one: TLSCipherPSK=kECDHEPSK+AES128 Now that you understand how it works you can test the ciphersuite selection even outside of Zabbix, with the `openssl` command. Let's test all three `TLSCipher*` parameter values: $ openssl ciphers EECDH+aRSA+AES128 | sed 's/:/ /g' TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA $ openssl ciphers kECDHEPSK+AES128 | sed 's/:/ /g' TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA $ openssl ciphers EECDH+aRSA+AES128:kECDHEPSK+AES128 | sed 's/:/ /g' TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA You may prefer `openssl ciphers` with option `-V` for a more verbose output: $ openssl ciphers -V EECDH+aRSA+AES128:kECDHEPSK+AES128 0x13,0x02 - TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD 0x13,0x03 - TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD 0x13,0x01 - TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD 0xC0,0x2F - ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD 0xC0,0x27 - ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 0xC0,0x13 - ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 0xC0,0x37 - ECDHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA256 0xC0,0x35 - ECDHE-PSK-AES128-CBC-SHA TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA1 Similarly, you can test the priority strings for GnuTLS: $ gnutls-cli -l --priority=NONE:+VERS-TLS1.2:+ECDHE-RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509 Cipher suites for NONE:+VERS-TLS1.2:+ECDHE-RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509 TLS_ECDHE_RSA_AES_128_GCM_SHA256 0xc0, 0x2f TLS1.2 TLS_ECDHE_RSA_AES_128_CBC_SHA256 0xc0, 0x27 TLS1.2 Protocols: VERS-TLS1.2 Ciphers: AES-128-GCM, AES-128-CBC MACs: AEAD, SHA256 Key Exchange Algorithms: ECDHE-RSA Groups: GROUP-SECP256R1, GROUP-SECP384R1, GROUP-SECP521R1, GROUP-X25519, GROUP-X448, GROUP-FFDHE2048, GROUP-FFDHE3072, GROUP-FFDHE4096, GROUP-FFDHE6144, GROUP-FFDHE8192 PK-signatures: SIGN-RSA-SHA256, SIGN-RSA-PSS-SHA256, SIGN-RSA-PSS-RSAE-SHA256, SIGN-ECDSA-SHA256, SIGN-ECDSA-SECP256R1-SHA256, SIGN-EdDSA-Ed25519, SIGN-RSA-SHA384, SIGN-RSA-PSS-SHA384, SIGN-RSA-PSS-RSAE-SHA384, SIGN-ECDSA-SHA384, SIGN-ECDSA-SECP384R1-SHA384, SIGN-EdDSA-Ed448, SIGN-RSA-SHA512, SIGN-RSA-PSS-SHA512, SIGN-RSA-PSS-RSAE-SHA512, SIGN-ECDSA-SHA512, SIGN-ECDSA-SECP521R1-SHA512, SIGN-RSA-SHA1, SIGN-ECDSA-SHA1
zh-cn	##### 测试密码字符串并只允许PFS密码套件 要查看哪些加密套件已经被选中，你需要在配置文件中设置'DebugLevel=4'，或者对zabbix\_sender使用' -vv '选项。 在获得所需的密码组之前，可能需要对“TLSCipher*”参数进行一些实验。 为了调整“TLSCipher*”参数，多次重启Zabbix server、proxy或agent是不方便的。 更方便的选项是使用zabbix\_sender或' openssl '命令。 让我们几种都看看如何实现。 **1.** 使用 zabbix\_sender. 让我们做一个测试配置文件，例如/home/zabbix/test.conf，使用zabbix\_agentd.conf文件的规则: Hostname=nonexisting ServerActive=nonexisting TLSConnect=cert TLSCAFile=/home/zabbix/ca.crt TLSCertFile=/home/zabbix/agent.crt TLSKeyFile=/home/zabbix/agent.key TLSPSKIdentity=nonexisting TLSPSKFile=/home/zabbix/agent.psk 在本例中，您需要有效的CA和代理证书以及PSK。 为您的环境调整证书和PSK文件路径和名称。 如果你不使用证书，而只使用PSK，你可以制作一个更简单的测试文件: Hostname=nonexisting ServerActive=nonexisting TLSConnect=psk TLSPSKIdentity=nonexisting TLSPSKFile=/home/zabbix/agentd.psk 运行zabbix\_sender(用OpenSSL 1.1.d编译的例子)可以看到所选的密码套件: $ zabbix_sender -vv -c /home/zabbix/test.conf -k nonexisting_item -o 1 2>&1 | grep ciphersuites zabbix_sender [41271]: DEBUG: zbx_tls_init_child() certificate ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES128-GCM-SHA256 AES128-CCM8 AES128-CCM AES128-SHA256 AES128-SHA zabbix_sender [41271]: DEBUG: zbx_tls_init_child() PSK ciphersuites: TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA PSK-AES128-GCM-SHA256 PSK-AES128-CCM8 PSK-AES128-CCM PSK-AES128-CBC-SHA256 PSK-AES128-CBC-SHA zabbix_sender [41271]: DEBUG: zbx_tls_init_child() certificate and PSK ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES128-GCM-SHA256 AES128-CCM8 AES128-CCM AES128-SHA256 AES128-SHA ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA PSK-AES128-GCM-SHA256 PSK-AES128-CCM8 PSK-AES128-CCM PSK-AES128-CBC-SHA256 PSK-AES128-CBC-SHA 这里可以看到默认选择的密码套件。 选择这些默认值是为了确保与运行在较早OpenSSL版本(从1.0.1开始)的系统上的Zabbix代理的互操作性。 在较新的系统中，你可以选择通过只允许一些密码套件来加强安全性，例如。 只有PFS(完全向前保密)密码套件。 让我们尝试只允许使用' TLSCipher* '参数的PFS加密套件。 ::: noteimportant 如果使用PSK，结果将无法与使用OpenSSL 1.0.1和1.0.2的系统进行互操作。 基于证书的加密应该可以工作。 ::: 添加两行到' test.conf '配置文件: TLSCipherCert=EECDH+aRSA+AES128 TLSCipherPSK=kECDHEPSK+AES128 然后再测试一次: $ zabbix_sender -vv -c /home/zabbix/test.conf -k nonexisting_item -o 1 2>&1 | grep ciphersuites zabbix_sender [42892]: DEBUG: zbx_tls_init_child() certificate ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA zabbix_sender [42892]: DEBUG: zbx_tls_init_child() PSK ciphersuites: TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA zabbix_sender [42892]: DEBUG: zbx_tls_init_child() certificate and PSK ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES128-GCM-SHA256 AES128-CCM8 AES128-CCM AES128-SHA256 AES128-SHA ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA PSK-AES128-GCM-SHA256 PSK-AES128-CCM8 PSK-AES128-CCM PSK-AES128-CBC-SHA256 PSK-AES128-CBC-SHA “证书密码套件”和“PSK密码套件”列表已更改 - 它们比以前短，只包含预期的TLS 1.3加密套件和TLS 1.2 ECDHE-\*加密套件。 **2.** TLSCipherAll和TLSCipherAll13不能被zabbix\_sender测试; 它们不会影响上面示例中显示的“证书和PSK密码套件”的值。 要调整TLSCipherAll和TLSCipherAll13，你需要用agent、proxy或server进行实验。 因此，为了只允许PFS密码套件，您可能需要添加最多三个参数 TLSCipherCert=EECDH+aRSA+AES128 TLSCipherPSK=kECDHEPSK+AES128 TLSCipherAll=EECDH+aRSA+AES128:kECDHEPSK+AES128 如果zabbix\_agentd.conf、zabbix\_proxy.conf和zabbix\_server\_conf都配置了证书，并且agent也有PSK。 如果Zabbix环境只使用基于psk的加密并且没有证书，那么只有一个: TLSCipherPSK=kECDHEPSK+AES128 现在您已经了解了它的工作原理，您可以在Zabbix之外使用“openssl”命令测试密码套件的选择。 让我们测试三个' TLSCipher* '参数值: $ openssl ciphers EECDH+aRSA+AES128 | sed 's/:/ /g' TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA $ openssl ciphers kECDHEPSK+AES128 | sed 's/:/ /g' TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA $ openssl ciphers EECDH+aRSA+AES128:kECDHEPSK+AES128 | sed 's/:/ /g' TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA 你可能更喜欢 `openssl ciphers` 带参数 `-V` 执行 得到更详细的信息 输出: $ openssl ciphers -V EECDH+aRSA+AES128:kECDHEPSK+AES128 0x13,0x02 - TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD 0x13,0x03 - TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD 0x13,0x01 - TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD 0xC0,0x2F - ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD 0xC0,0x27 - ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 0xC0,0x13 - ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 0xC0,0x37 - ECDHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA256 0xC0,0x35 - ECDHE-PSK-AES128-CBC-SHA TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA1 类似地，你可以测试GnuTLS的优先级字符串: $ gnutls-cli -l --priority=NONE:+VERS-TLS1.2:+ECDHE-RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509 Cipher suites for NONE:+VERS-TLS1.2:+ECDHE-RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509 TLS_ECDHE_RSA_AES_128_GCM_SHA256 0xc0, 0x2f TLS1.2 TLS_ECDHE_RSA_AES_128_CBC_SHA256 0xc0, 0x27 TLS1.2 Protocols: VERS-TLS1.2 Ciphers: AES-128-GCM, AES-128-CBC MACs: AEAD, SHA256 Key Exchange Algorithms: ECDHE-RSA Groups: GROUP-SECP256R1, GROUP-SECP384R1, GROUP-SECP521R1, GROUP-X25519, GROUP-X448, GROUP-FFDHE2048, GROUP-FFDHE3072, GROUP-FFDHE4096, GROUP-FFDHE6144, GROUP-FFDHE8192 PK-signatures: SIGN-RSA-SHA256, SIGN-RSA-PSS-SHA256, SIGN-RSA-PSS-RSAE-SHA256, SIGN-ECDSA-SHA256, SIGN-ECDSA-SECP256R1-SHA256, SIGN-EdDSA-Ed25519, SIGN-RSA-SHA384, SIGN-RSA-PSS-SHA384, SIGN-RSA-PSS-RSAE-SHA384, SIGN-ECDSA-SHA384, SIGN-ECDSA-SECP384R1-SHA384, SIGN-EdDSA-Ed448, SIGN-RSA-SHA512, SIGN-RSA-PSS-SHA512, SIGN-RSA-PSS-RSAE-SHA512, SIGN-ECDSA-SHA512, SIGN-ECDSA-SECP521R1-SHA512, SIGN-RSA-SHA1, SIGN-ECDSA-SHA1

en	##### Switching from AES128 to AES256 Zabbix uses AES128 as the built-in default for data. Let's assume you are using certificates and want to switch to AES256, on OpenSSL 1.1.1. This can be achieved by adding the respective parameters in `zabbix_server.conf`: TLSCAFile=/home/zabbix/ca.crt TLSCertFile=/home/zabbix/server.crt TLSKeyFile=/home/zabbix/server.key TLSCipherCert13=TLS_AES_256_GCM_SHA384 TLSCipherCert=EECDH+aRSA+AES256:-SHA1:-SHA384 TLSCipherPSK13=TLS_CHACHA20_POLY1305_SHA256 TLSCipherPSK=kECDHEPSK+AES256:-SHA1 TLSCipherAll13=TLS_AES_256_GCM_SHA384 TLSCipherAll=EECDH+aRSA+AES256:-SHA1:-SHA384 ::: noteimportant Although only certificate-related ciphersuites will be used, `TLSCipherPSK*` parameters are defined as well to avoid their default values which include less secure ciphers for wider interoperability. PSK ciphersuites cannot be completely disabled on server/proxy. ::: And in `zabbix_agentd.conf`: TLSConnect=cert TLSAccept=cert TLSCAFile=/home/zabbix/ca.crt TLSCertFile=/home/zabbix/agent.crt TLSKeyFile=/home/zabbix/agent.key TLSCipherCert13=TLS_AES_256_GCM_SHA384 TLSCipherCert=EECDH+aRSA+AES256:-SHA1:-SHA384
zh-cn	##### 从AES128 到 AES256切换 Zabbix 使用 AES128 作为数据的内置默认值。假设您正在使用证书并希望在 OpenSSL 1.1.1 上切换到 AES256。 这可以通过在配置文件中添加相应的参数来实现。 `zabbix_server.conf`: TLSCAFile=/home/zabbix/ca.crt TLSCertFile=/home/zabbix/server.crt TLSKeyFile=/home/zabbix/server.key TLSCipherCert13=TLS_AES_256_GCM_SHA384 TLSCipherCert=EECDH+aRSA+AES256:-SHA1:-SHA384 TLSCipherPSK13=TLS_CHACHA20_POLY1305_SHA256 TLSCipherPSK=kECDHEPSK+AES256:-SHA1 TLSCipherAll13=TLS_AES_256_GCM_SHA384 TLSCipherAll=EECDH+aRSA+AES256:-SHA1:-SHA384 ::: noteimportant 虽然只会使用与证书相关的密码套件，但也定义了 `TLSCipherPSK*` 参数，以避免其默认值包含为更广泛的互操作性而设计的安全性较低的密码。PSK 密码套件不能在server/proxy上完全禁用。 ::: 和在 `zabbix_agentd.conf`: TLSConnect=cert TLSAccept=cert TLSCAFile=/home/zabbix/ca.crt TLSCertFile=/home/zabbix/agent.crt TLSKeyFile=/home/zabbix/agent.key TLSCipherCert13=TLS_AES_256_GCM_SHA384 TLSCipherCert=EECDH+aRSA+AES256:-SHA1:-SHA384