Áú»¢¶Ä²©

17. §º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö

§°§Ò§Ù§à§â

Áú»¢¶Ä²© §á§à§Õ§Õ§Ö§â§Ø§Ú§Ó§Ñ§Ö§ä §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§Û §Þ§Ö§Ø§Õ§å Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â§à§Þ, Áú»¢¶Ä²© §á§â§à§Ü§ã§Ú, Áú»¢¶Ä²© §Ñ§Ô§Ö§ß§ä§à§Þ, zabbix_sender §Ú zabbix_get §å§ä§Ú§Ý§Ú§ä§Ñ§Þ§Ú §ã §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ß§Ú§Ö§Þ Transport Layer Security (TLS) §á§â§à§ä§à§Ü§à§Ý§Ñ v.1.2. §º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §á§à§Õ§Õ§Ö§â§Ø§Ú§Ó§Ñ§Ö§ä§ã§ñ §ß§Ñ§é§Ú§ß§Ñ§ñ §ã Áú»¢¶Ä²© 3.0. §±§à§Õ§Õ§Ö§â§Ø§Ú§Ó§Ñ§ð§ä§ã§ñ §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ §Ú §ß§Ñ §à§ã§ß§à§Ó§Ö pre-shared §Ü§Ý§ð§é§Ñ.

§º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §à§á§è§Ú§à§ß§Ñ§Ý§î§ß§à §Ú §ß§Ñ§ã§ä§â§Ñ§Ú§Ó§Ñ§Ö§ä§ã§ñ §Õ§Ý§ñ §à§ä§Õ§Ö§Ý§î§ß§í§ç §Ü§à§Þ§á§à§ß§Ö§ß§ä§à§Ó (§ß§Ñ§á§â§Ú§Þ§Ö§â, §ß§Ö§Ü§à§ä§à§â§í§Ö §á§â§à§Ü§ã§Ú §Ú §Ñ§Ô§Ö§ß§ä§í §Þ§à§Ø§ß§à §ß§Ñ§ã§ä§â§à§Ú§ä§î §ß§Ñ §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ß§Ú§Ö §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §ã §ã§Ö§â§Ó§Ö§â§à§Þ §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Ó, §Ó §ä§à §Ó§â§Ö§Þ§ñ §Ü§Ñ§Ü §Õ§â§å§Ô§Ú§Ö §Þ§à§Ô§å§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ß§Ñ §à§ã§ß§à§Ó§Ö pre-shared §Ü§Ý§ð§é§Ñ, §Ñ §à§ã§ä§Ñ§Ý§î§ß§í§Ö §Þ§à§Ô§å§ä §á§â§à§Õ§à§Ý§Ø§Ñ§ä§î §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §ß§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§ß§í§Ö §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §Ü§Ñ§Ü §Ú §â§Ñ§ß§Ö§Ö).

§³§Ö§â§Ó§Ö§â (§á§â§à§Ü§ã§Ú) §Þ§à§Ø§Ö§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §â§Ñ§Ù§Ý§Ú§é§ß§í§Ö §ß§Ñ§ã§ä§â§à§Û§Ü§Ú §ã §â§Ñ§Ù§ß§í§Þ§Ú §å§Ù§Ý§Ñ§Þ§Ú §ã§Ö§ä§Ú.

§±§â§à§Ô§â§Ñ§Þ§Þ§í Áú»¢¶Ä²© §Õ§Ö§Þ§à§ß§à§Ó §ã§Ý§å§ê§Ñ§ð§ä §à§Õ§Ú§ß §á§à§â§ä §Õ§Ý§ñ §ê§Ú§æ§â§à§Ó§Ñ§ß§ß§í§ç §Ú §ß§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§ß§í§ç §Ó§ç§à§Õ§ñ§ë§Ú§ç §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§Û. §¥§à§Ò§Ñ§Ó§Ý§Ö§ß§Ú§Ö §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §ß§Ö §á§à§ä§â§Ö§Ò§å§Ö§ä §à§ä§Ü§â§í§Ó§Ñ§ä§î §ß§à§Ó§í§Ö §á§à§â§ä§í §ß§Ñ §Ò§â§Ñ§ß§Õ§Þ§Ñ§å§ï§â§Ñ§ç.

§°§Ô§â§Ñ§ß§Ú§é§Ö§ß§Ú§ñ

• §±§â§Ú§Ó§Ñ§ä§ß§í§Ö §Ü§Ý§ð§é§Ú §ç§â§Ñ§ß§ñ§ä§ã§ñ §Ó §æ§à§â§Þ§Ñ§ä§Ö §à§Ò§í§é§ß§à§Ô§à §ä§Ö§Ü§ã§ä§Ñ §Ó §æ§Ñ§Û§Ý§Ñ§ç, §Ü§à§ä§à§â§í§Ö Áú»¢¶Ä²© §Ü§à§Þ§á§à§ß§Ö§ß§ä§í §ã§é§Ú§ä§í§Ó§Ñ§ð§ä §Ó §á§â§à§è§Ö§ã§ã§Ö §Ù§Ñ§á§å§ã§Ü§Ñ.
• §£§Ó§Ö§Õ§Ö§ß§ß§í§Ö pre-shared §Ü§Ý§ð§é§Ú §Ó §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ö Áú»¢¶Ä²© §ç§â§Ñ§ß§ñ§ä§ã§ñ §Ó §Ò§Ñ§Ù§Ö §Õ§Ñ§ß§ß§í§ç Áú»¢¶Ä²© §Ó §Ó§Ú§Õ§Ö §à§Ò§í§é§ß§à§Ô§à §ä§Ö§Ü§ã§ä§Ñ.
• §£§ã§ä§â§à§Ö§ß§ß§à§Ö §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ß§Ö §Ù§Ñ§ë§Ú§ë§Ñ§Ö§ä §Ü§à§Þ§Þ§å§ß§Ú§Ü§Ñ§è§Ú§Ú:

   * §Þ§Ö§Ø§Õ§å §Ó§Ö§Ò-§ã§Ö§â§Ó§Ö§â§à§Þ §ã §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§à§Þ Áú»¢¶Ä²© §Ú §Ó§Ö§Ò-§Ò§â§Ñ§å§Ù§Ö§â§à§Þ §ß§Ñ §ã§ä§â§à§ß§Ö §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§ñ,
          * §Þ§Ö§Ø§Õ§å Áú»¢¶Ä²© §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§à§Þ §Ú Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â§à§Þ,
          * §Þ§Ö§Ø§Õ§å Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â§à§Þ (§á§â§à§Ü§ã§Ú) §Ú §Ò§Ñ§Ù§à§Û §Õ§Ñ§ß§ß§í§ç Áú»¢¶Ä²©.
       * §£ §ß§Ñ§ã§ä§à§ñ§ë§Ö§Ö §Ó§â§Ö§Þ§ñ §Ü§Ñ§Ø§Õ§à§Ö §ß§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§ß§à§Ö §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§Ö §à§ä§Ü§â§í§Ó§Ñ§Ö§ä§ã§ñ §ã §á§à§Ý§ß§í§Þ§Ú TLS §á§Ö§â§Ö§Ô§à§Ó§à§â§Ñ§Þ§Ú, §Ü§ï§ê§Ú§â§à§Ó§Ñ§ß§Ú§Ö §ã§Ö§ã§ã§Ú§Û §Ú §Ò§Ú§Ý§Ö§ä§í §ß§Ö §â§Ö§Ñ§Ý§Ú§Ù§à§Ó§Ñ§ß§í.
       * §¥§à§Ò§Ñ§Ó§Ý§Ö§ß§Ú§Ö §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §å§Ó§Ö§Ý§Ú§é§Ú§Ó§Ñ§Ö§ä §Ó§â§Ö§Þ§ñ §á§â§à§Ó§Ö§â§à§Ü §Ú §Õ§Ö§Û§ã§ä§Ó§Ú§Û, §Ó §Ù§Ñ§Ó§Ú§ã§Ú§Þ§à§ã§ä§Ú §à§ä §ã§Ö§ä§Ö§Ó§í§ç §Ù§Ñ§Õ§Ö§â§Ø§Ö§Ü.\\ §¯§Ñ§á§â§Ú§Þ§Ö§â, §Ö§ã§Ý§Ú §á§Ñ§Ü§Ö§ä §à§á§Ñ§Ù§Õ§í§Ó§Ñ§Ö§ä §ß§Ñ 100§Þ§ã, §ä§à§Ô§Õ§Ñ §à§ä§Ü§â§í§ä§Ú§Ö TCP §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§Ö §Ú §à§ä§á§â§Ñ§Ó§Ü§Ñ §ß§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§ß§à§Ô§à §Ù§Ñ§á§â§à§ã§Ñ §Ù§Ñ§Û§Þ§Ö§ä §à§Ü§à§Ý§à 200§Þ§ã.\\ §±§â§Ú §ß§Ñ§Ý§Ú§é§Ú§Ú §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §ß§Ñ §å§ã§ä§Ñ§ß§à§Ó§Ü§å TLS §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §Õ§à§Ò§Ñ§Ó§Ú§ä§ã§ñ §à§Ü§à§Ý§à 1000 §Þ§ã.\\ §£§à§Ù§Þ§à§Ø§ß§à §á§à§ä§â§Ö§Ò§å§Ö§ä§ã§ñ §å§Ó§Ö§Ý§Ú§é§Ú§ä§î §Ó§â§Ö§Þ§ñ §à§Ø§Ú§Õ§Ñ§ß§Ú§ñ, §Ó §á§â§à§ä§Ú§Ó§ß§à§Þ §ã§Ý§å§é§Ñ§Ö §ß§Ö§Ü§à§ä§à§â§í§Ö §ï§Ý§Ö§Þ§Ö§ß§ä§í §Õ§Ñ§ß§ß§í§ç §Ú §Õ§Ö§Û§ã§ä§Ó§Ú§ñ, §Ó§í§á§à§Ý§ß§ñ§ð§ë§Ú§Ö §å§Õ§Ñ§Ý§Ö§ß§ß§í§Ö §ã§Ü§â§Ú§á§ä§í §ß§Ñ §Ñ§Ô§Ö§ß§ä§Ñ§ç §ã§Þ§à§Ô§å§ä §â§Ñ§Ò§à§ä§Ñ§ä§î §ã §ß§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§ß§í§Þ§Ú §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ§Þ§Ú,\\ §ß§à §ß§Ö §ã§Þ§à§Ô§å§ä §á§â§Ú §ê§Ú§æ§â§à§Ó§Ñ§ß§ß§à§Þ §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§Ú (§Ò§å§Õ§Ö§ä §á§â§Ö§Ó§í§ê§Ö§ß§à §Ó§â§Ö§Þ§ñ §à§Ø§Ú§Õ§Ñ§ß§Ú§ñ).

§¬§à§Þ§á§Ú§Ý§ñ§è§Ú§ñ Áú»¢¶Ä²© §ã §á§à§Õ§Õ§Ö§â§Ø§Ü§à§Û §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ

§¥§Ý§ñ §á§à§Õ§Õ§Ö§â§Ø§Ü§Ú §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ Áú»¢¶Ä²© §Õ§à§Ý§Ø§Ö§ß §Ò§í§ä§î §ã§Ü§à§Þ§á§Ú§Ý§Ú§â§à§Ó§Ñ§ä§î §Ú §ã§Ó§ñ§Ù§Ñ§ß §ã §á§à §Ü§â§Ñ§Û§ß§Ö§Û §Þ§Ö§â§Ö §à§Õ§ß§à§Û §Ü§â§Ú§á§ä§à §Ò§Ú§Ò§Ý§Ú§à§ä§Ö§Ü§à§Û:

• mbed TLS (§â§Ñ§ß§Ö§Ö PolarSSL)(§Ó§Ö§â§ã§Ú§ñ 1.3.9 §Ú§Ý§Ú §Ò§à§Ý§Ö§Ö §ß§à§Ó§í§Ö 1.3.x). mbed TLS 2.x §Ó §ß§Ñ§ã§ä§à§ñ§ë§Ö§Ö §Ó§â§Ö§Þ§ñ §ß§Ö §á§à§Õ§Õ§Ö§â§Ø§Ú§Ó§Ñ§Ö§ä§ã§ñ, §ï§ä§à §ß§Ö §á§â§à§ã§ä§Ñ§ñ §Ù§Ñ§Þ§Ö§ß§Ñ §Ó§Ö§ä§Ü§Ú 1.3, Áú»¢¶Ä²© §ß§Ö §ã§Ü§à§Þ§á§Ú§Ý§Ú§â§å§Ö§ä§ã§ñ §ã mbed TLS 2.x.
• GnuTLS (§ã §Ó§Ö§â§ã§Ú§Ú 3.1.18)
• OpenSSL (§ã §Ó§Ö§â§ã§Ú§Ú 1.0.1)

§¢§Ú§Ò§Ý§Ú§à§ä§Ö§Ü§Ñ §Ó§í§Ò§Ú§â§Ñ§Ö§ä§ã§ñ §á§â§Ú §á§à§Þ§à§ë§Ú §à§á§è§Ú§Ú §Ó §ã§Ü§â§Ú§á§ä§Ö "configure":

• --with-mbedtls[=DIR]
• --with-gnutls[=DIR]
• --with-openssl[=DIR]

§¯§Ñ§á§â§Ú§Þ§Ö§â, §é§ä§à§Ò§í §ã§Ü§à§ß§æ§Ú§Ô§å§â§Ú§â§à§Ó§Ñ§ä§î §Ú§ã§ç§à§Õ§ß§í§Ö §Ü§à§Õ§í §ã§Ö§â§Ó§Ö§â§Ñ §Ú §Ñ§Ô§Ö§ß§ä§Ñ §ã OpenSSL, §Ó§í §Þ§à§Ø§Ö§ä§Ö §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §é§ä§à-§ä§à §Ó§â§à§Õ§Ö:
./configure --enable-server --enable-agent --with-mysql --enable-ipv6 --with-net-snmp --with-libcurl --with-libxml2 --with-openssl

§®§à§Ø§ß§à §ã§Ü§à§Þ§á§Ú§Ý§Ú§â§à§Ó§Ñ§ä§î §â§Ñ§Ù§ß§í§Ö §Ü§à§Þ§á§à§ß§Ö§ß§ä§í Áú»¢¶Ä²© §ã §â§Ñ§Ù§Ý§Ú§é§ß§í§Þ§Ú §Ü§â§Ú§á§ä§à §Ò§Ú§Ò§Ý§Ú§à§ä§Ö§Ü§Ñ§Þ§Ú (§ß§Ñ§á§â§Ú§Þ§Ö§â, §ã§Ö§â§Ó§Ö§â §ã OpenSSL, §Ñ§Ô§Ö§ß§ä §ã GnuTLS).

§µ§á§â§Ñ§Ó§Ý§Ö§ß§Ú§Ö §Ù§Ñ§ê§Ú§â§à§Ó§Ñ§ß§ß§í§Þ§Ú §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ§Þ§Ú

§³§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §Ó Áú»¢¶Ä²© §Þ§à§Ô§å§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î:

• §Ò§Ö§Ù §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ (§á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð)
• RSA §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Ó
• §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ß§Ñ §à§ã§ß§à§Ó§Ö PSK

§ª§Þ§Ö§Ö§ä§ã§ñ §Õ§Ó§Ñ §Ó§Ñ§Ø§ß§í§ç §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ñ, §Ü§à§ä§à§â§í§Ö §Ú§ã§á§à§Ý§î§Ù§å§ð§ä§ã§ñ, §é§ä§à§Ò§í §å§Ü§Ñ§Ù§Ñ§ä§î §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §Þ§Ö§Ø§Õ§å §Ü§à§Þ§á§à§ß§Ö§ß§ä§Ñ§Þ§Ú Áú»¢¶Ä²©:

• TLSConnect
• TLSAccept

TLSConnect §Ù§Ñ§Õ§Ñ§Ö§ä §Ü§Ñ§Ü§à§Ö §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §Ú §Þ§à§Ø§Ö§ä §á§â§Ú§ß§Ú§Þ§Ñ§ä§î §à§Õ§ß§à §Ú§Ù 3 §Ù§ß§Ñ§é§Ö§ß§Ú§Û (unencrypted, PSK, certificate). TLSConnect §Ú§ã§á§à§Ý§î§Ù§å§Ö§ä§ã§ñ §Ó §æ§Ñ§Û§Ý§Ñ§ç §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú Áú»¢¶Ä²© §á§â§à§Ü§ã§Ú (§Ó §Ñ§Ü§ä§Ú§Ó§ß§à§Þ §â§Ö§Ø§Ú§Þ§Ö §Ù§Ñ§Õ§Ñ§Ö§ä §ä§à§Ý§î§Ü§à §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §Ü §ã§Ö§â§Ó§Ö§â§å) §Ú Áú»¢¶Ä²© agentd (§á§â§Ú §Ñ§Ü§ä§Ú§Ó§ß§í§ç §á§â§à§Ó§Ö§â§Ü§Ñ§ç). §£ §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ö Áú»¢¶Ä²© §á§Ñ§â§Ñ§Þ§Ö§ä§â TLSConnect §ñ§Ó§Ý§ñ§Ö§ä§ã§ñ §ï§Ü§Ó§Ú§Ó§Ñ§Ý§Ö§ß§ä§à§Þ §á§à§Ý§ñ §±§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §Ü §å§Ù§Ý§å §ã§Ö§ä§Ú §ã §Ó§Ü§Ý§Ñ§Õ§Ü§Ú §¯§Ñ§ã§ä§â§à§Û§Ü§Ñ¡ú§µ§Ù§Ý§í §ã§Ö§ä§Ú¡ú<§Ü§Ñ§Ü§à§Û-§ä§à §å§Ù§Ö§Ý §ã§Ö§ä§Ú>¡ú§º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §Ú §á§à§Ý§ñ §±§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §Ü §á§â§à§Ü§ã§Ú §ã §Ó§Ü§Ý§Ñ§Õ§Ü§Ú §¡§Õ§Þ§Ú§ß§Ú§ã§ä§â§Ú§â§à§Ó§Ñ§ß§Ú§Ö¡ú§±§â§à§Ü§ã§Ú¡ú<§Ü§Ñ§Ü§à§Û-§ä§à §á§â§à§Ü§ã§Ú>¡ú§º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö. §¦§ã§Ý§Ú §ß§Ñ§ã§ä§â§à§Ö§ß§ß§í§Û §ä§Ú§á §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §Õ§Ý§ñ §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §Ù§Ñ§Ó§Ö§â§ê§Ú§ä§ã§ñ §ß§Ö§å§Õ§Ñ§é§Ö§Û, §Õ§â§å§Ô§Ú§Ö §ä§Ú§á§í §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §ß§Ö §Ò§å§Õ§å§ä §à§á§â§à§Ò§à§Ó§Ñ§ß§í.

TLSAccept §Ù§Ñ§Õ§Ñ§Ö§ä §Ü§Ñ§Ü§à§Û §ä§Ú§á §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§Û §â§Ñ§Ù§â§Ö§ê§Ö§ß §á§â§Ú §Ó§ç§à§Õ§ñ§ë§Ú§ç §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ§ç. §´§Ú§á §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§Û: unencrypted, PSK, certificate. §®§à§Ø§ß§à §å§Ü§Ñ§Ù§Ñ§ä§î §à§Õ§ß§à §Ú§Ý§Ú §Ò§à§Ý§Ö§Ö §Ù§ß§Ñ§é§Ö§ß§Ú§Û. TLSAccept §Ú§ã§á§à§Ý§î§Ù§å§Ö§ä§ã§ñ §Ó §æ§Ñ§Û§Ý§Ñ§ç §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú Áú»¢¶Ä²© §á§â§à§Ü§ã§Ú (§Ó §á§Ñ§ã§ã§Ú§Ó§ß§à§Þ §â§Ö§Ø§Ú§Þ§Ö §Ù§Ñ§Õ§Ñ§Ö§ä §ä§à§Ý§î§Ü§à §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §ã §ã§Ö§â§Ó§Ö§â§Ñ) §Ú Áú»¢¶Ä²© agentd (§á§â§Ú §á§Ñ§ã§ã§Ú§Ó§ß§í§ç §á§â§à§Ó§Ö§â§Ü§Ñ§ç). §£ §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ö Áú»¢¶Ä²© §á§Ñ§â§Ñ§Þ§Ö§ä§â TLSAccept §ñ§Ó§Ý§ñ§Ö§ä§ã§ñ §ï§Ü§Ó§Ú§Ó§Ñ§Ý§Ö§ß§ä§à§Þ §á§à§Ý§ñ §³§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §ã §å§Ù§Ý§Ñ §ã§Ö§ä§Ú §ã §Ó§Ü§Ý§Ñ§Õ§Ü§Ú §¯§Ñ§ã§ä§â§à§Û§Ü§Ñ¡ú§µ§Ù§Ý§í §ã§Ö§ä§Ú¡ú<§Ü§Ñ§Ü§à§Û-§ä§à §å§Ù§Ö§Ý §ã§Ö§ä§Ú>¡ú§º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §Ú §á§à§Ý§ñ "§³§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §ã §á§â§à§Ü§ã§Ú" §ã §Ó§Ü§Ý§Ñ§Õ§Ü§Ú §¡§Õ§Þ§Ú§ß§Ú§ã§ä§â§Ú§â§à§Ó§Ñ§ß§Ú§Ö¡ú§±§â§à§Ü§ã§Ú¡ú<§Ü§Ñ§Ü§à§Û-§ä§à §á§â§à§Ü§ã§Ú>¡ú§º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö.

§¬§Ñ§Ü §á§â§Ñ§Ó§Ú§Ý§à, §Ó§í §ß§Ñ§ã§ä§â§Ñ§Ú§Ó§Ñ§Ö§ä§Ö §ä§à§Ý§î§Ü§à §à§Õ§Ú§ß §ä§Ú§á §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §Õ§Ý§ñ §Ó§ç§à§Õ§ñ§ë§Ú§ç §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§Û. §¯§à §Ó§í §Þ§à§Ø§Ö§ä§Ö §Ù§Ñ§ç§à§ä§Ú§ä§Ö §á§Ö§â§Ö§Ü§Ý§ð§é§Ú§ä§î §â§Ö§Ø§Ú§Þ §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ, §ß§Ñ§á§â§Ú§Þ§Ö§â §ã §ß§Ö§Ù§Ñ§ê§Ú§â§à§Ó§Ñ§ß§ß§à§Ô§à §ß§Ñ §à§ã§ß§à§Ó§Ñ§ß§ß§í§Û §ß§Ñ §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ§ç §ã §Þ§Ú§ß§Ú§Þ§Ñ§Ý§î§ß§í§Þ §Ó§â§Ö§Þ§Ö§ß§Ö§Þ §á§â§à§ã§ä§à§ñ §Ú §ã §Ó§à§Ù§Þ§à§Ø§ß§à§ã§ä§î§ð §à§ä§Ü§Ñ§ä§Ñ. §¥§Ý§ñ §ï§ä§à§Ô§à §Ó§í §Þ§à§Ø§Ö§ä§Ö §Ù§Ñ§Õ§Ñ§ä§î TLSAccept=unencrypted,cert §Ó §æ§Ñ§Û§Ý§Ö §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú agentd §Ú §á§Ö§â§Ö§Ù§Ñ§á§å§ã§ä§Ú§ä§î §Ñ§Ô§Ö§ß§ä§Ñ Áú»¢¶Ä²©.
§©§Ñ§ä§Ö§Þ §Ó§í §Þ§à§Ø§Ö§ä§Ö §á§â§à§ä§Ö§ã§ä§Ú§â§à§Ó§Ñ§ä§î §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§Ö §à§ä zabbix_get §Ü §Ñ§Ô§Ö§ß§ä§å, §Ú§ã§á§à§Ý§î§Ù§å§ñ §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä. §¦§ã§Ý§Ú §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§Ö §â§Ñ§Ò§à§ä§Ñ§Ö§ä, §Ó§í §Þ§à§Ø§Ö§ä§Ö §á§Ö§â§Ö§ß§Ñ§ã§ä§â§à§Ú§ä§î §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §å §ï§ä§à§Ô§à §Ñ§Ô§Ö§ß§ä§Ñ §Ó Áú»¢¶Ä²© §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ö §ß§Ñ §Ó§Ü§Ý§Ñ§Õ§Ü§Ö §¯§Ñ§ã§ä§â§à§Û§Ü§Ñ¡ú§µ§Ù§Ý§í §ã§Ö§ä§Ú¡ú<§Ü§Ñ§Ü§à§Û-§ä§à §å§Ù§Ö§Ý §ã§Ö§ä§Ú>¡ú§º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö, §á§Ö§â§Ö§Ü§Ý§ð§é§Ú§Ó §ß§Ñ§ã§ä§â§à§Û§Ü§å §±§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §Ü §å§Ù§Ý§å §ã§Ö§ä§Ú §ß§Ñ "§³§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä".
§¬§à§Ô§Õ§Ñ §Ü§ï§ê §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §ã§Ö§â§Ó§Ö§â§Ñ §à§Ò§ß§à§Ó§Ú§ä§ã§ñ (§Ú §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§ñ §á§â§à§Ü§ã§Ú §à§Ò§ß§à§Ó§Ú§ä§ã§ñ, §Ö§ã§Ý§Ú §å§Ù§Ö§Ý §ã§Ö§ä§Ú §ß§Ñ§Ò§Ý§ð§Õ§Ñ§Ö§ä§ã§ñ §é§Ö§â§Ö§Ù §á§â§à§Ü§ã§Ú), §ä§à§Ô§Õ§Ñ §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §Ü §ï§ä§à§Þ§å §Ñ§Ô§Ö§ß§ä§å §Ò§å§Õ§å§ä §Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§í.
§¦§ã§Ý§Ú §Ó§ã§× §â§Ñ§Ò§à§ä§Ñ§Ö§ä §Ü§Ñ§Ü §à§Ø§Ú§Õ§Ñ§Ö§ä§ã§ñ, §Ó§í §Þ§à§Ø§Ö§ä§Ö §Ù§Ñ§Õ§Ñ§ä§î TLSAccept=cert §Ó §æ§Ñ§Û§Ý§Ö §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §Ñ§Ô§Ö§ß§ä§Ñ §Ú §á§Ö§â§Ö§Ù§Ñ§á§å§ã§ä§Ú§ä§î Áú»¢¶Ä²© §Ñ§Ô§Ö§ß§ä§Ñ.
§´§Ö§á§Ö§â§î §Ñ§Ô§Ö§ß§ä §Ò§å§Õ§Ö§ä §á§â§Ú§ß§Ú§Þ§Ñ§ä§î §ä§à§Ý§î§Ü§à §Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§ß§í§Ö §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Ó. §¯§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§ß§í§Ö §Ú §à§ã§ß§à§Ó§Ñ§ß§ß§í§Ö §ß§Ñ PSK §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §Ò§å§Õ§å§ä §à§ä§Ü§Ý§à§ß§Ö§ß§í.

§º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ß§Ñ §ã§Ö§â§Ó§Ö§â§Ö §Ú §á§â§à§Ü§ã§Ú §â§Ñ§Ò§à§ä§Ñ§Ö§ä §Ñ§ß§Ñ§Ý§à§Ô§Ú§é§ß§í§Þ §à§Ò§â§Ñ§Ù§à§Þ. §¦§ã§Ý§Ú §Ó §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ö Áú»¢¶Ä²© §Ó §ß§Ñ§ã§ä§â§à§Û§Ü§Ö §å§Ù§Ý§Ñ §ã§Ö§ä§Ú §³§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §ã §å§Ù§Ý§Ñ §ã§Ö§ä§Ú §Ù§Ñ§Õ§Ñ§ß§à §â§Ñ§Ó§ß§í§Þ "§³§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä", §ä§à§Ô§Õ§Ñ §à§ä §Ñ§Ô§Ö§ß§ä§Ñ (§Ñ§Ü§ä§Ú§Ó§ß§í§Ö §á§â§à§Ó§Ö§â§Ü§Ú) §Ú zabbix_sender (§ä§â§Ñ§á§á§Ö§â §ï§Ý§Ö§Þ§Ö§ß§ä§í §Õ§Ñ§ß§ß§í§ç) §Ò§å§Õ§å§ä §á§â§Ú§ß§Ú§Þ§Ñ§ä§î§ã§ñ §ä§à§Ý§î§Ü§à §Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§ß§í§Ö §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Ó.

§³§Ü§à§â§Ö§Ö §Ó§ã§Ö§Ô§à §Ó§í §ß§Ñ§ã§ä§â§à§Ú§ä§Ö §Ó§ç§à§Õ§ñ§ë§Ú§Ö §Ú §Ú§ã§ç§à§Õ§ñ§ë§Ú§Ö §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §ß§Ñ §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ß§Ú§Ö §à§Õ§ß§à§Ô§à §ä§Ú§á§Ñ §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §Ú§Ý§Ú §Ò§Ö§Ù §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §Ó§à§Ó§ã§Ö. §¯§à, §ä§Ö§ç§ß§Ú§é§Ö§ã§Ü§Ú, §Ú§Þ§Ö§Ö§ä§ã§ñ §Ó§à§Ù§Þ§à§Ø§ß§à§ã§ä§î §ß§Ñ§ã§ä§â§à§Ú§ä§î §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §Ñ§ã§Ú§Þ§Þ§Ö§ä§â§Ú§é§ß§à, §ß§Ñ§á§â§Ú§Þ§Ö§â, §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Ó §Õ§Ý§ñ §Ó§ç§à§Õ§ñ§ë§Ú§ç §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§Û §Ú §ß§Ñ §à§ã§ß§à§Ó§Ö PSK §Õ§Ý§ñ §Ú§ã§ç§à§Õ§ñ§ë§Ú§ç §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§Û.

§°§Ò§Ù§à§â§ß§í§Ö §ß§Ñ§ã§ä§â§à§Û§Ü§Ú §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §à§ä§à§Ò§â§Ñ§Ø§Ñ§ð§ä§ã§ñ §Ó §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ö Áú»¢¶Ä²© §¯§Ñ§ã§ä§â§à§Û§Ü§Ñ¡ú§µ§Ù§Ý§í §ã§Ö§ä§Ú §á§à §Ü§Ñ§Ø§Õ§à§Þ§å §å§Ù§Ý§å §ã§Ö§ä§Ú §á§à §á§â§Ñ§Ó§à§Û §ã§ä§à§â§à§ß§Ö, §Ó §Ü§à§Ý§à§ß§Ü§Ö §º§ª§¶§²§°§£§¡§¯§ª§¦ §¡§¤§¦§¯§´§¡. §±§â§Ú§Þ§Ö§â§í §à§ä§à§Ò§â§Ñ§Ø§Ö§ß§Ú§ñ §ß§Ñ§ã§ä§â§à§Ö§Ü:

§±§â§Ú§Þ§Ö§â	§±§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §¬ §å§Ù§Ý§å §ã§Ö§ä§Ú	§²§Ñ§Ù§â§Ö§ê§Ö§ß§ß§í§Ö §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §°§´ §å§Ù§Ý§Ñ §ã§Ö§ä§Ú	§°§ä§Ü§Ý§à§ß§Ö§ß§ß§í§Ö §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §³ §å§Ù§Ý§Ñ §ã§Ö§ä§Ú
	§¯§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à	§¯§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à	§©§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ §Ú PSK
	§©§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à, §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ	§©§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à, §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ	§¯§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à §Ú §ß§Ñ §à§ã§ß§à§Ó§Ö PSK
	§©§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à §ß§Ñ §à§ã§ß§à§Ó§Ö PSK	§©§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à §ß§Ñ §à§ã§ß§à§Ó§Ö PSK	§¯§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à §Ú §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ
	§©§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à §ß§Ñ §à§ã§ß§à§Ó§Ö PSK	§¯§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à §Ú §Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à §ß§Ñ §à§ã§ß§à§Ó§Ö PSK	§¯§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ
	§©§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ	§¯§Ö§Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à §ß§Ñ §à§ã§ß§à§Ó§Ö PSK §Ú§Ý§Ú §Ù§Ñ§ê§Ú§æ§â§à§Ó§Ñ§ß§à §ß§Ñ §à§ã§ß§à§Ó§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ	-

zabbix_get §Ú zabbix_sender §ã §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö§Þ

§³§Þ§à§ä§â§Ú§ä§Ö §ã§ä§â§Ñ§ß§Ú§è§í §á§à§Þ§à§ë§Ú zabbix_get §Ú zabbix_sender §á§à §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ß§Ú§ð §ï§ä§Ú§ç §å§ä§Ú§Ý§Ú§ä §á§â§Ú §ß§Ñ§Ý§Ú§é§Ú§Ú §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ.

§¡§Ý§Ô§à§â§Ú§ä§Þ§í §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ

§¡§Ý§Ô§à§â§Ú§ä§Þ§í §Ü§à§ß§æ§Ú§Ô§å§â§Ú§â§å§ð§ä§ã§ñ §Ó§ß§å§ä§â§Ú §Ó §á§â§à§è§Ö§ã§ã§Ö §Ù§Ñ§á§å§ã§Ü§Ñ Áú»¢¶Ä²© §Ú §Ù§Ñ§Ó§Ú§ã§ñ§ä §à§ä §Ü§â§Ú§á§ä§à §Ò§Ú§Ò§Ý§Ú§à§ä§Ö§Ü§Ú, §Ó §ß§Ñ§ã§ä§à§ñ§ë§Ö§Ö §Ó§â§Ö§Þ§ñ §Ñ§Ý§Ô§à§â§Ú§ä§Þ§í §ß§Ö§Ý§î§Ù§ñ §ß§Ñ§ã§ä§â§Ñ§Ú§Ó§Ñ§ä§î §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§ñ§Þ§Ú.

§¯§Ñ§ã§ä§â§à§Ö§ß§ß§í§Ö §Ñ§Ý§Ô§à§â§Ú§ä§Þ§í §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §á§à §ä§Ú§á§å §Ò§Ú§Ò§Ý§Ú§ä§Ö§Ü§Ú §ã §Ò§à§Ý§Ö§Ö §Ó§í§ã§à§Ü§à§Ô§à §å§â§à§Ó§ß§ñ §Ü §ß§Ú§Ù§Ü§à§Þ§å §å§â§à§Ó§ß§ð:

§¡§Ý§Ô§à§â§Ú§ä§Þ§í §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §á§â§Ú §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ß§Ú§Ú §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Ó:

§¡§Ý§Ô§à§â§Ú§ä§Þ§í §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §á§â§Ú §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ß§Ú§Ú PSK:

User-configured ciphersuites

The built-in ciphersuite selection criteria can be overridden with user-configured ciphersuites.

The built-in ciphersuite selection criteria can be overridden using the following parameters:

To override the ciphersuite selection in zabbix_get and zabbix_sender utilities - use the command-line parameters:

• --tls-cipher13
• --tls-cipher

The new parameters are optional. If a parameter is not specified, the internal default value is used. If a parameter is defined it cannot be empty.

If the setting of a TLSCipher* value in the crypto library fails then the server, proxy or agent will not start and an error is logged.

It is important to understand when each parameter is applicable.

Outgoing connections

The simplest case is outgoing connections:

• For outgoing connections with certificate - use TLSCipherCert13 or TLSCipherCert
• For outgoing connections with PSK - use TLSCipherPSK13 and TLSCipherPSK
• In case of zabbix_get and zabbix_sender utilities the command-line parameters --tls-cipher13 and --tls-cipher can be used (encryption is unambiguously specified with a --tls-connect parameter)

Incoming connections

It is a bit more complicated with incoming connections because rules are specific for components and configuration.

For Áú»¢¶Ä²© agent:

For Áú»¢¶Ä²© server and ** proxy**:

Some pattern can be seen in the two tables above:

• TLSCipherAll and TLSCipherAll13 can be specified only if a combined list of certificate- and PSK-based ciphersuites is used. There are two cases when it takes place: server (proxy) with a configured certificate (PSK ciphersuites are always configured on server, proxy if crypto library supports PSK), agent configured to accept both certificate- and PSK-based incoming connections
• in other cases TLSCipherCert* and/or TLSCipherPSK* are sufficient

The following tables show the TLSCipher* built-in default values. They could be a good starting point for your own custom values.

¹ Default values are different for older OpenSSL versions (1.0.1, 1.0.2, 1.1.0), for LibreSSL and if OpenSSL is compiled without PSK support.

** Examples of user-configured ciphersuites **

See below the following examples of user-configured ciphersuites:

• Testing cipher strings and allowing only PFS ciphersuites
• Switching from AES128 to AES256

Testing cipher strings and allowing only PFS ciphersuites

To see which ciphersuites have been selected you need to set 'DebugLevel=4' in the configuration file, or use the -vv option for zabbix_sender.

Some experimenting with TLSCipher* parameters might be necessary before you get the desired ciphersuites. It is inconvenient to restart Áú»¢¶Ä²© server, proxy or agent multiple times just to tweak TLSCipher* parameters. More convenient options are using zabbix_sender or the openssl command. Let's show both.

1. Using zabbix_sender.

Let's make a test configuration file, for example /home/zabbix/test.conf, with the syntax of a zabbix_agentd.conf file:

  Hostname=nonexisting
         ServerActive=nonexisting
         
         TLSConnect=cert
         TLSCAFile=/home/zabbix/ca.crt
         TLSCertFile=/home/zabbix/agent.crt
         TLSKeyFile=/home/zabbix/agent.key
         TLSPSKIdentity=nonexisting
         TLSPSKFile=/home/zabbix/agent.psk

You need valid CA and agent certificates and PSK for this example. Adjust certificate and PSK file paths and names for your environment.

If you are not using certificates, but only PSK, you can make a simpler test file:

  Hostname=nonexisting
         ServerActive=nonexisting
         
         TLSConnect=psk
         TLSPSKIdentity=nonexisting
         TLSPSKFile=/home/zabbix/agentd.psk

The selected ciphersuites can be seen by running zabbix_sender (example compiled with OpenSSL 1.1.d):

  $ zabbix_sender -vv -c /home/zabbix/test.conf -k nonexisting_item -o 1 2>&1 | grep ciphersuites
         zabbix_sender [41271]: DEBUG: zbx_tls_init_child() certificate ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES128-GCM-SHA256 AES128-CCM8 AES128-CCM AES128-SHA256 AES128-SHA
         zabbix_sender [41271]: DEBUG: zbx_tls_init_child() PSK ciphersuites: TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA PSK-AES128-GCM-SHA256 PSK-AES128-CCM8 PSK-AES128-CCM PSK-AES128-CBC-SHA256 PSK-AES128-CBC-SHA
         zabbix_sender [41271]: DEBUG: zbx_tls_init_child() certificate and PSK ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES128-GCM-SHA256 AES128-CCM8 AES128-CCM AES128-SHA256 AES128-SHA ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA PSK-AES128-GCM-SHA256 PSK-AES128-CCM8 PSK-AES128-CCM PSK-AES128-CBC-SHA256 PSK-AES128-CBC-SHA

Here you see the ciphersuites selected by default. These default values are chosen to ensure interoperability with Áú»¢¶Ä²© agents running on systems with older OpenSSL versions (from 1.0.1).

With newer systems you can choose to tighten security by allowing only a few ciphersuites, e.g. only ciphersuites with PFS (Perfect Forward Secrecy). Let's try to allow only ciphersuites with PFS using TLSCipher* parameters.

Add two lines to the test.conf configuration file:

  TLSCipherCert=EECDH+aRSA+AES128
         TLSCipherPSK=kECDHEPSK+AES128

and test again:

  $ zabbix_sender -vv -c /home/zabbix/test.conf -k nonexisting_item -o 1 2>&1 | grep ciphersuites            
         zabbix_sender [42892]: DEBUG: zbx_tls_init_child() certificate ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA        
         zabbix_sender [42892]: DEBUG: zbx_tls_init_child() PSK ciphersuites: TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA        
         zabbix_sender [42892]: DEBUG: zbx_tls_init_child() certificate and PSK ciphersuites: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES128-GCM-SHA256 AES128-CCM8 AES128-CCM AES128-SHA256 AES128-SHA ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA PSK-AES128-GCM-SHA256 PSK-AES128-CCM8 PSK-AES128-CCM PSK-AES128-CBC-SHA256 PSK-AES128-CBC-SHA        

The "certificate ciphersuites" and "PSK ciphersuites" lists have changed - they are shorter than before, only containing TLS 1.3 ciphersuites and TLS 1.2 ECDHE-* ciphersuites as expected.

2. TLSCipherAll and TLSCipherAll13 cannot be tested with zabbix_sender; they do not affect "certificate and PSK ciphersuites" value shown in the example above. To tweak TLSCipherAll and TLSCipherAll13 you need to experiment with the agent, proxy or server.

So, to allow only PFS ciphersuites you may need to add up to three parameters

  TLSCipherCert=EECDH+aRSA+AES128
         TLSCipherPSK=kECDHEPSK+AES128
         TLSCipherAll=EECDH+aRSA+AES128:kECDHEPSK+AES128

to zabbix_agentd.conf, zabbix_proxy.conf and zabbix_server_conf if each of them has a configured certificate and agent has also PSK.

If your Áú»¢¶Ä²© environment uses only PSK-based encryption and no certificates, then only one:

  TLSCipherPSK=kECDHEPSK+AES128

Now that you understand how it works you can test the ciphersuite selection even outside of Áú»¢¶Ä²©, with the openssl command. Let's test all three TLSCipher* parameter values:

  $ openssl ciphers EECDH+aRSA+AES128 | sed 's/:/ /g'
         TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA
         $ openssl ciphers kECDHEPSK+AES128 | sed 's/:/ /g'
         TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA
         $ openssl ciphers EECDH+aRSA+AES128:kECDHEPSK+AES128 | sed 's/:/ /g'
         TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES128-CBC-SHA
         

You may prefer openssl ciphers with option -V for a more verbose output:

  $ openssl ciphers -V EECDH+aRSA+AES128:kECDHEPSK+AES128
                   0x13,0x02 - TLS_AES_256_GCM_SHA384  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(256) Mac=AEAD
                   0x13,0x03 - TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any      Au=any  Enc=CHACHA20/POLY1305(256) Mac=AEAD
                   0x13,0x01 - TLS_AES_128_GCM_SHA256  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(128) Mac=AEAD
                   0xC0,0x2F - ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD
                   0xC0,0x27 - ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA256
                   0xC0,0x13 - ECDHE-RSA-AES128-SHA    TLSv1 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA1
                   0xC0,0x37 - ECDHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK  Enc=AES(128)  Mac=SHA256
                   0xC0,0x35 - ECDHE-PSK-AES128-CBC-SHA TLSv1 Kx=ECDHEPSK Au=PSK  Enc=AES(128)  Mac=SHA1

Similarly, you can test the priority strings for GnuTLS:

  $ gnutls-cli -l --priority=NONE:+VERS-TLS1.2:+ECDHE-RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
         Cipher suites for NONE:+VERS-TLS1.2:+ECDHE-RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
         TLS_ECDHE_RSA_AES_128_GCM_SHA256                        0xc0, 0x2f      TLS1.2
         TLS_ECDHE_RSA_AES_128_CBC_SHA256                        0xc0, 0x27      TLS1.2
         
         Protocols: VERS-TLS1.2
         Ciphers: AES-128-GCM, AES-128-CBC
         MACs: AEAD, SHA256
         Key Exchange Algorithms: ECDHE-RSA
         Groups: GROUP-SECP256R1, GROUP-SECP384R1, GROUP-SECP521R1, GROUP-X25519, GROUP-X448, GROUP-FFDHE2048, GROUP-FFDHE3072, GROUP-FFDHE4096, GROUP-FFDHE6144, GROUP-FFDHE8192
         PK-signatures: SIGN-RSA-SHA256, SIGN-RSA-PSS-SHA256, SIGN-RSA-PSS-RSAE-SHA256, SIGN-ECDSA-SHA256, SIGN-ECDSA-SECP256R1-SHA256, SIGN-EdDSA-Ed25519, SIGN-RSA-SHA384, SIGN-RSA-PSS-SHA384, SIGN-RSA-PSS-RSAE-SHA384, SIGN-ECDSA-SHA384, SIGN-ECDSA-SECP384R1-SHA384, SIGN-EdDSA-Ed448, SIGN-RSA-SHA512, SIGN-RSA-PSS-SHA512, SIGN-RSA-PSS-RSAE-SHA512, SIGN-ECDSA-SHA512, SIGN-ECDSA-SECP521R1-SHA512, SIGN-RSA-SHA1, SIGN-ECDSA-SHA1

Switching from AES128 to AES256

Áú»¢¶Ä²© uses AES128 as the built-in default for data. Let's assume you are using certificates and want to switch to AES256, on OpenSSL 1.1.1.

This can be achieved by adding the respective parameters in zabbix_server.conf:

  TLSCAFile=/home/zabbix/ca.crt
         TLSCertFile=/home/zabbix/server.crt
         TLSKeyFile=/home/zabbix/server.key
         TLSCipherCert13=TLS_AES_256_GCM_SHA384
         TLSCipherCert=EECDH+aRSA+AES256:-SHA1:-SHA384
         TLSCipherPSK13=TLS_CHACHA20_POLY1305_SHA256
         TLSCipherPSK=kECDHEPSK+AES256:-SHA1
         TLSCipherAll13=TLS_AES_256_GCM_SHA384
         TLSCipherAll=EECDH+aRSA+AES256:-SHA1:-SHA384

And in zabbix_agentd.conf:

  TLSConnect=cert
         TLSAccept=cert
         TLSCAFile=/home/zabbix/ca.crt
         TLSCertFile=/home/zabbix/agent.crt
         TLSKeyFile=/home/zabbix/agent.key
         TLSCipherCert13=TLS_AES_256_GCM_SHA384
         TLSCipherCert=EECDH+aRSA+AES256:-SHA1:-SHA384