added TLS support for agents; added example CA and cert

README.md

@@ -1 +1,24 @@
+# Default username/password
+
 Admin:zabbix
+
+# TLS
+
+## Generate CA
+
+### Generate CA key
+openssl genrsa -passout env:CA_PASSWD -aes256 -out zabbix-ca.key 4096
+### Generate CA
+openssl req -x509 -new -key zabbix-ca.key -sha256 -days 36500 -out zabbix-ca.crt -passin env:CA_PASSWD -subj "/CN=zabbix-server"
+
+## Generate host cert
+
+### Set host variable
+HOST=zabbix-host.domain.tld
+### Generate host key and csr
+openssl req -new -newkey rsa:4096 -nodes -keyout "${HOST}.key" -out "${HOST}.csr" -subj "/CN=${HOST}"
+### Generate host cert
+openssl x509 -req -CA zabbix-ca.crt -CAkey zabbix-ca.key -CAcreateserial -days 36500 -sha256 -passin env:CA_PASSWD -in "${HOST}.csr" -out "${HOST}.crt"
+### Remove csr
+rm "${HOST}.csr"
+

zabbix/Dockerfile

@@ -40,6 +40,11 @@ COPY ./vars-files /etc/vars-files
 
 COPY ./run.sh /run.sh
 
+COPY ./certs/* /etc/zabbix/certs/
+
+RUN chown zabbix:zabbix /etc/zabbix/certs/* &&\
+    chmod 400 /etc/zabbix/certs/*
+
 EXPOSE 80
 
 USER zabbix

zabbix/certs/zabbix-ca.crt

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIFCDCCAvCgAwIBAgIJANzZeiiqIRC7MA0GCSqGSIb3DQEBCwUAMBgxFjAUBgNV
+BAMMDXphYmJpeC1zZXJ2ZXIwIBcNMTkwMTExMDAxODQ0WhgPMjExODEyMTgwMDE4
+NDRaMBgxFjAUBgNVBAMMDXphYmJpeC1zZXJ2ZXIwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQDM+26RI/t1ltRN+HQItojCKwx6zM8qiDKZzoG13H1fwhQ0
+DN2YrWpcUXc0zaNRGcDIPNELIEQXHEGNWINNVkL1ffttmvXjinjIe1bumWoxCqiG
+TA1cSh3zZ22HnK633vHuHUhQngX7vvOkJ4XBk0sAQWfU1194yOsr5s5PRS48SngV
+qRdocgMiyS5RwAXTWGsofjrBRQWk3XkaD1RIeCULIPAXKUlGyTQxYxnvmtaJKizN
+wDyDG7SJsl7Qk6RXGSXmeMZo8pDVI7nn3tItx5XLZ8eKN9HFrCMNhY3qi4Y/yBlx
+f1k5Yru6ujEwbUbalwPfCDtEx6IcH0pTsBidpwTPdQbjpC67CH/y+C262PUJubCv
+JJHYm8geBDkk0YXdAzMLIGVfZZNh3yzj7Y0KCHXzaGk2OXaMM3aZcDmyWGNI499E
+jIJMvqtkppGVnVYeDsK3rtOAk9D+kMY0wncBOKTVrq4uTpb5POQCcToYRYrRRgV3
+u38+jc5d73ZhOeS+VxNxvPwAhWynn1mA1J7j43pJVAKdy0nkTtxbNKsm+thJc0SU
+2IKpwcr0ssy+1S9PkCXOT6TyhbaYjsus3j/FviCWUHbkF927v0TCdf9RnzVFWLRi
+MBe9k/cG2Xx9lfyFzvxpj52X54WENIPAW+TWAIh6bXUQtk/VeU+1On2yjMlvKQID
+AQABo1MwUTAdBgNVHQ4EFgQUqQs+/qvMn/kOcpGAsCpNhMUEAfowHwYDVR0jBBgw
+FoAUqQs+/qvMn/kOcpGAsCpNhMUEAfowDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
+9w0BAQsFAAOCAgEAHxkaPKWgG2qulh/ZsTWdwvU/jqv9Tdcj80ln/vnfZCSefBqp
+LBB13NeIXXl+u/yL4MhamwwYrZPWYEKP7zemj10BaVVuSoF8OSwriTrxWBUQ3qoR
+fFJmGyA180ghJeuPbXgT0JjAJyxUedTuxYPM/1XfPX4mYxfPEtl/Qz1N+0Huaez0
+EszRe3BFgvXois/m0MFvuXpms2ptRZOodmC1Bvosx/awfpp+7LLGSP8CYLfE6bOH
+Zvhnu/RG5B+Fed+kvDs6Kn4erruRLZL79pbjfvPSB1hrLyhdfVtmYANppgSXOpFb
+C2NB0AsfXK3xGVc+cmF93qN4M1JrL8p1RtJyPnt8ptrMvt0mt2zNuXZQReDP1eYv
+PVrhIbpwGZ164CNIbBSE1DhOjd0hzIUGRUcWC3/gMBVXbVRpy5yRavhAsy/AxHYM
+G2s29D/4hYYAUa3EQxFv4v7jsgxmY5m1kV4SwF/4X1D+mvWDHo9l77382W3Q4uLL
+MYWNyBtjyICicRg6lKCgpt99XKE5AzblJTAGpxUhQbVU27/l1dgBTICDj4xXhh5F
+jxoN1LrGCBvMqDhZ7umpQWAa+wJb+nK6wq1TnvHYNvXjuFCbctx75rkHKIiT/H3W
+hUPoU/jF23LfgLFTctOFFVIX87ixBfQhfwLRk5i9KD6LFFIH9HTPKk6qDzE=
+-----END CERTIFICATE-----

zabbix/certs/zabbix-server.crt

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIErjCCApYCCQDWlhRoK+VAyDANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA16
+YWJiaXgtc2VydmVyMCAXDTE5MDExMTAwMTkxMFoYDzIxMTgxMjE4MDAxOTEwWjAY
+MRYwFAYDVQQDDA16YWJiaXgtc2VydmVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
+MIICCgKCAgEApEWBo4KoT+5wBIAHZZAeOs7fmkxVqRur6FEUvWHr1gHbOwYlJ9UM
+3v0S18zs56DGcdnljJQMf5tC3I+O2M5WrDHG+qj+4ck2p85hGGK3sX5OO3uB3a3t
+RKzl75o6dlnfB91pVjHkQwQnsug9ZBhmi4GB1ICowsA1SuzHX6t+3k3EprmAsbsx
+Hs8eLt+W6O/IrZfTQi2+wyPQ3mOmvA2v2XpHCHm7x9vzv7buZPVpdxyPaNffBax1
+0HT4VulSb3j+7z0beh+xMQXr3/OAnD0wSWGvcOIMB4dkiv1TfSrhSOfcuQnuzVl7
+ucYgJbl9fHODD75ARtCzFpuA7rR/2C3zSdKFjteq89DYbQzZ4b5DYmjpAqj8LP2D
+iOuoUj062z6EDMcGCvWTspWmxkFJfVOsj62syEnH/mAD2pDFhhqufASJOfgg3PFn
+oXe49eBZsyMCqktir5Oq5yQSup/Jj5n55ySZGN71SMH8kl8mQxKqs0vzoVzWQd7n
+IN58bwgd7khiq379w1hE9QrCYmTqFq1kM8iRhiEwykfJcnS1J0Qer1aSk4UDr9Ja
+tdS+EuXTnc5xnT4AAvF+BI+XgJjMrYmlbDZBw2W61eGvPwYOaTOseSLd9QAySRuu
+Hawrr6ju5rixY/lg1F62je+p/Mvn4cYH7nM2dt0hD+aMPE/oJHRT98cCAwEAATAN
+BgkqhkiG9w0BAQsFAAOCAgEAcaffTpIMhyNHI62Irb+QtKycqRN5mYbtUZaHjOWS
+rF2w8yoew7snfqO18ELHewQ1Lbk5h6dEKLQWuReFWnliHRW2MWWRB73Fq0MALoE3
+T+YwB/XzKD2Wc7ApF4DyEBhtE+WX0q5JcqSV4oYrrw0fMTItEg2pB2yIRT+bDqXn
++dHs8PqUBtdxkucVKXGnkcQU2qYoShOrwT9giW+logN0NUfCra974i5ocswVKYDb
+zHKxDyvUdD9nNmD9uLOfZIInEeUz7FTVKQXjAnO6lRMPiHXmoyd8iA/cTvMNOsNO
+qvMPM6pOaEY6kBOOlIrO2fhdDIKQOD1HFmFEB2jRAUFUA7lO4iRb1FaKTEqw5lFp
+dnptTjXGKYIatZ2u2FZoY5+E5s2Nh1b/5Y4PhSfLUN4XdMfpE3I7yNRjuV7MqbaZ
+Xd53/dUHclcU31u7NQXTM96IEn1UK1M5pReZD0Cw4p5d1DFPYDRa4nibNUphtfNU
+4gmpKXGusb1yabMkLveYs5MlIbg3Azy7UF5d72+FyaYd7qEt7vCxwCXFe4t8pqES
+u8W3SWJqSXwNyPrsuSwb3h1PNkY8nxQE2WNUvYr2jZ+HnhNVb8E5H/FP39sPHhh+
++ZHeHKCZGI5E16tFsqOsNXJyH9991Bt1jEHD/og74EFvUeX8J8XZqL7fJjsG+Ju9
+sAQ=
+-----END CERTIFICATE-----

zabbix/certs/zabbix-server.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCkRYGjgqhP7nAE
+gAdlkB46zt+aTFWpG6voURS9YevWAds7BiUn1Qze/RLXzOznoMZx2eWMlAx/m0Lc
+j47YzlasMcb6qP7hyTanzmEYYrexfk47e4Hdre1ErOXvmjp2Wd8H3WlWMeRDBCey
+6D1kGGaLgYHUgKjCwDVK7Mdfq37eTcSmuYCxuzEezx4u35bo78itl9NCLb7DI9De
+Y6a8Da/ZekcIebvH2/O/tu5k9Wl3HI9o198FrHXQdPhW6VJveP7vPRt6H7ExBevf
+84CcPTBJYa9w4gwHh2SK/VN9KuFI59y5Ce7NWXu5xiAluX18c4MPvkBG0LMWm4Du
+tH/YLfNJ0oWO16rz0NhtDNnhvkNiaOkCqPws/YOI66hSPTrbPoQMxwYK9ZOylabG
+QUl9U6yPrazIScf+YAPakMWGGq58BIk5+CDc8Wehd7j14FmzIwKqS2Kvk6rnJBK6
+n8mPmfnnJJkY3vVIwfySXyZDEqqzS/OhXNZB3ucg3nxvCB3uSGKrfv3DWET1CsJi
+ZOoWrWQzyJGGITDKR8lydLUnRB6vVpKThQOv0lq11L4S5dOdznGdPgAC8X4Ej5eA
+mMytiaVsNkHDZbrV4a8/Bg5pM6x5It31ADJJG64drCuvqO7muLFj+WDUXraN76n8
+y+fhxgfuczZ23SEP5ow8T+gkdFP3xwIDAQABAoICADXElmE5o/O9vKaMbV9d47cl
+/WRYtfULHKKG3335biL3KpXQNhsqjfLy7Nb7uVM7eZjMVGlGEC04WZMt3fiy2QW1
+qUZkSEEJBj24vGkp7qxHBj5L977ibfX7jat2VMpmMi012IOhAvC4jHHvuCBqKC5j
+bmZq0lIkbY0foUZ8MKN82vAjaa9C8Rn/ewamopON4KaJOlm/9V+T+orAHVQSOsu5
+TUTF66PIJ6lJrBAZj7KwA3Syq8oEn+9iSeLQre3UscUGwFahxvKf2IvN/Pumv4ZV
+VgJhysQwGcWwk0I15dViJwnd6W8HagrtgZo3c45nlK9ze0BykRvGPFZleC7/I1Ex
+LGs4uGrdkVJ2XxuayR26wmNabs63jAwdUkr3LRgqifv30VWYJjvBfG8/oSo7HLze
+3Jbmafql7OZXPur+G9oqnc08pbquKF5gbe6OFWyu8oEHUGO6zkli5Gki3pzrQ3S6
+LZagnPmBJFaxLfUWK6ZrgliYOPR/DGGiePNxpmZDDwyo3o1uN8O2loa9VkFgN0K3
+H2Pn6eQ7i+kRTgoAtkvPpFq3wwDaDCw1Y7AelUITKKYRzjaMq6K43Vkos86SXE1v
+8Z10blEDNEkNOck77J3fmgA2j5o1c2FwDYeLH4CVWrzyHV3eqCWbsfiiuKphu4jS
+dz4A2fCRG2jNmrUvy7/5AoIBAQDTMIqCGEejXbKVboe3NvwSim0+lvLdjtXabFq+
+NLMHtx9LJjjAP3p3VfKAHGhG061mRnWy01bQVE2QzlrlBj17Czx2sInUNmSeh9zD
+bXOJujg71FAn5+p6Zd42+hrvNCTGUxwWqdGNoBgq8wOyDTgXN5tuSnRbK+MZC4Yr
+uWQPb8upI4xz1XRblTdsKOnWieljGK3lhBGm60uEsTxfm2oLb+yCa4tOcxPHsxZl
+JWTdIdQ1Q9Tvj86XMYJVNlKcUBy3r6Ro04RlkLDcluf7jeC0KCAYXmZm22vhw+w8
+JKrMskOkCtSl1/JczMbWtYAK5AF7KT3l/VW7kMWLu2KWTn6bAoIBAQDHIHRAVZw+
+5qwyZa7nl+FYK41BOHjbyminQP/kaoT4icGOed/d/ypclgNDhzX2Gd2eD2iq+IIv
+QEX6VFkVkWxAVgZCi8sQ1wJKMVxfsd6FkMRWTxLG/4z070AduTmSDWZ0ol9I4Nsz
+GRxlJXv6RVQSaiEuxO9fLbGeN+arduhdnmVL1MTUBhO1iNSR5Nycs6kW6HoCWGeN
+5xVeLavrQIQ/PCnRuije4PVwtNnwJCj4P6virHI8kqWrEGm3/mHSspo2GxjFB89M
+9sB1W7FRQTHtXoLyZ0+qK7NusQtF2SSzHU3jSgqCpwPhWSe5V+O/xZRSZ48Cekrw
+2ef2OH23lQhFAoIBAFKcVlH1dXBuIoFZrzT4CTqnc3xcR7xrNzQt1oE41B9cfp1C
+4kgxjJJJyIZcll2+R8IOJdRB31+22nCeh+e2vS34gzpabE/axxlMRAseMWfatEyT
+DJfPnGUsm/QdeZPAbfI2aHJlE1e3HD0Quo1Xpm1OjzphXYqcbEVLwLwx1PZE4QHU
+qghVoyKACCIDDxWg9O6SpNN3CgClYfER82/it2Sp73ZE40VYtpATedsu+XmW1g/P
+7OeY9VMnRrhWe5IxtEoWJtXqh4vDQavITA6WvSM73vIpWx05D8ZMgYg1P6q6wMLW
+icAl7ORoJg+vB9s6vWmUBGaG5pZsVxoFvtbU9akCggEBAMDXIT4cqpAP/Lth1hza
+7ZThuI5tDj5sqyUuwaKHtfasEhLU3IS1VGUNsmN3Uj7flcw4x/iraggwipR/kzZb
++yXjKXTQxPut/b20R+006HcZV8ruERU+71dVTBZ9Bs/2wj458WU2vZGiw+kAgCxD
+b8PVnAUbG2Zlbhn3sSBkq2veteLWTze2Gug3dwVDSpNHOn3A7kfPLZozLHJkcJYH
+iQtkTGubiXEvEwLvYhA6NKMVpnSC5K7cpiwgXQGfDUVrSgUUAMzvX0b9wCzne7Vh
+GeTzHoV6n6ABamfMdUpTnEMKIh/32G3nKM7X9Kx9/UX/JkEXoVuY63KM1SOSWc2s
+OrECggEBALMBmlLGYnQM5Xlf4FYwCzfIOCE+SzVzy9eHlmSHWbiMvHi9YGLGfO25
+aJnKxf/N6EoR7wb9K+v6GN37Mm7TUgoWkD67P+kAwm9uh3Q2p8eDvh9L+iC/BpOl
+0UpXYQzoP/9Ncslx6fWROHDMHAPCioDM8eFdR3KoLBh5MZ8di/K9rWC0pfdWvnNI
+6Vp/ETru+VhoG17zIlCoWuj5ui/bKGIc4BLy4gey5Gn5IZ1wNBKbGJP/QCrTA2TT
+A+Se+pnwkyOU110NBVl5L1Uni67ECYKUHSP6pUhPgO1Z3Ij1sa8C801yCdi8H7pI
+fY1TZMXMVBTw0bNZwSV4lXkSr4e4VOk=
+-----END PRIVATE KEY-----

zabbix/zabbix_server.conf

@@ -654,7 +654,7 @@ LogSlowQueries=3000
 #
 # Mandatory: no
 # Default:
-# TLSCAFile=
+TLSCAFile=/etc/zabbix/certs/zabbix-ca.crt
 
 ### Option: TLSCRLFile
 #	Full pathname of a file containing revoked certificates.
@@ -668,11 +668,11 @@ LogSlowQueries=3000
 #
 # Mandatory: no
 # Default:
-# TLSCertFile=
+TLSCertFile=/etc/zabbix/certs/zabbix-server.crt
 
 ### Option: TLSKeyFile
 #	Full pathname of a file containing the server private key.
 #
 # Mandatory: no
 # Default:
-# TLSKeyFile=
+TLSKeyFile=/etc/zabbix/certs/zabbix-server.key