§°§Ó§Ñ §ã§Ö§Ü§è§Ú?§Ñ §á§â§å§Ø§Ñ §ß§Ö§Ü§à§Ý§Ú§Ü§à §á§â§Ú§Þ§Ö§â§Ñ §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú?§Ö §ê§Ú§æ§â§à§Ó§Ñ?§Ñ §Ù§Ñ CentOS 8.2 §Ú PostgreSQL 13.
§£§Ö§Ù§Ñ §Ú§Ù§Þ§Ö?§å Áú»¢¶Ä²© §Ü§à§â§Ú§ã§ß§Ú§é§Ü§à§Ô §Ú§ß§ä§Ö§â§æ§Ö?§ã§Ñ §Ú PostgreSQL-§Ñ §ß§Ö §Þ§à§Ø§Ö §Ò§Ú§ä§Ú §ê§Ú§æ§â§à§Ó§Ñ§ß§Ñ (§á§Ñ§â§Ñ§Þ§Ö§ä§â§Ú §å GUI §ã§å §à§ß§Ö§Þ§à§Ô§å?§Ö§ß§Ú), §Ñ§Ü§à §Ó§â§Ö§Õ§ß§à§ã§ä §á§à?§Ñ §¥§à§Þ§Ñ?§Ú§ß§Ñ §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §á§à§é§Ú?§Ö §Ü§à§ã§à§Þ §è§â§ä§à§Þ §Ú§Ý§Ú ?§Ö §á§à?§Ö §á§â§Ñ§Ù§ß§à.
§ª§ß§ã§ä§Ñ§Ý§Ú§â§Ñ?§ä§Ö PostgreSQL §Ò§Ñ§Ù§å §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §Ü§à§â§Ú§ã§ä§Ö?§Ú .
PostgreSQL §ß§Ú?§Ö §Ü§à§ß§æ§Ú§Ô§å§â§Ú§ã§Ñ§ß §Ù§Ñ §á§â§Ú§ç§Ó§Ñ§ä§Ñ?§Ö TLS §Ü§à§ß§Ö§Ü§è§Ú?§Ñ §Ó§Ñ§ß §Ü§å§ä§Ú?§Ö. §±§â§Ñ§ä§Ú§ä§Ö §å§á§å§ä§ã§ä§Ó§Ñ §Ú§Ù PostgreSQL §Õ§à§Ü§å§Þ§Ö§ß§ä§Ñ§è§Ú?§Ö §Ù§Ñ §Ú §ä§Ñ§Ü§à?§Ö §Ù§Ñ §á§â§Ö§Ü§à ph_hba.conf.
§±§à§Õ§â§Ñ§Ù§å§Þ§Ö§Ó§Ñ§ß§à, PostgreSQL §ã§à§Ü§Ö§ä ?§Ö §Ó§Ö§Ù§Ñ§ß §Ù§Ñ §Ý§à§Ü§Ñ§Ý§ß§Ú §Õ§à§Þ§Ñ?§Ú§ß, §Ù§Ñ §Þ§â§Ö§Ø§ß§Ö §å§Õ§Ñ?§Ö§ß§Ö §Ó§Ö§Ù§Ö §Ü§Ñ§Ü§à §Ò§Ú §ã§Ö §à§Þ§à§Ô§å?§Ú§Ý§à §ã§Ý§å§ê§Ñ?§Ö §ß§Ñ §ã§ä§Ó§Ñ§â§ß§à? §Þ§â§Ö§Ø§Ú §Ú§ß§ä§Ö§â§æ§Ö?§ã.
PostgreSQL §á§à§Õ§Ö§ê§Ñ§Ó§Ñ?§Ñ §Ù§Ñ §ã§Ó§Ö §â§Ö§Ø§Ú§Þ§Ú §Þ§à§Ø§Ö §Ú§Ù§Ô§Ý§Ö§Õ§Ñ§ä§Ú §Ü§Ñ§à §à§Ó§à:
/var/lib/pgsql/13/data/postgresql.conf:
...
ssl = on
ssl_ca_file = 'root.crt'
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'
ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL'
ssl_prefer_server_ciphers = on
ssl_min_protocol_version = 'TLSv1.3'
...
§©§Ñ §Ü§à§ß§ä§â§à§Ý§å §á§â§Ú§ã§ä§å§á§Ñ §á§à§Õ§Ö§ã§Ú§ä§Ö /var/lib/pgsql/13/data/pg_hba.conf:
...
### require
hostssl all all 0.0.0.0/0 md5
### verify CA
hostssl all all 0.0.0.0/0 md5 clientcert=verify-ca
### verify full
hostssl all all 0.0.0.0/0 md5 clientcert=verify-full
...
§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ§Þ§à §Ù§Ñ §ä§â§Ñ§ß§ã§á§à§â§ä §Ù§Ñ §Ó§Ö§Ù§Ö §Ú§Ù§Þ§Ö?§å Áú»¢¶Ä²© §Ü§à§â§Ú§ã§ß§Ú§é§Ü§à§Ô §Ú§ß§ä§Ö§â§æ§Ö?§ã§Ñ §Ú §Ò§Ñ§Ù§Ñ §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ:
§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ§Þ§à §Ù§Ñ §ä§â§Ñ§ß§ã§á§à§â§ä §Ù§Ñ §Ó§Ö§Ù§Ö §Ú§Ù§Þ§Ö?§å §ã§Ö§â§Ó§Ö§â§Ñ §Ú §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ, §Ü§à§ß§æ§Ú§Ô§å§â§Ú§ê§Ú§ä§Ö /etc/zabbix/zabbix_server.conf:
...
DBHost=10.211.55.9
DBName=zabbix
DBUser=zbx_srv
DBPassword=<strong_password>
DBTLSConnect=required
...
§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ §Ó§Ö§â§Ú§æ§Ú§Ü§Ñ§è§Ú?§à§Þ §Ñ§å§ä§à§â§Ú§ä§Ö§ä§Ñ §Ù§Ñ §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ö §Ù§Ñ §Ó§Ö§Ù§Ö §Ú§Ù§Þ§Ö?§å Áú»¢¶Ä²© §Ü§à§â§Ú§ã§ß§Ú§é§Ü§à§Ô §Ú§ß§ä§Ö§â§æ§Ö?§ã§Ñ §Ú §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ:
§¡§Ý§ä§Ö§â§ß§Ñ§ä§Ú§Ó§ß§à, §à§Ó§à §ã§Ö §Þ§à§Ø§Ö §á§à§Õ§Ö§ã§Ú§ä§Ú §å /etc/zabbix/web/zabbix.conf.php:
...
$DB['ENCRYPTION'] = true;
$DB['KEY_FILE'] = '';
$DB['CERT_FILE'] = '';
$DB['CA_FILE'] = '/etc/ssl/pgsql/root.crt';
$DB['VERIFY_HOST'] = false;
$DB['CIPHER_LIST'] = '';
...
§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ §Ó§Ö§â§Ú§æ§Ú§Ü§Ñ§è§Ú?§à§Þ §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ §Ù§Ñ §Ó§Ö§Ù§Ö §Ú§Ù§Þ§Ö?§å Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â§Ñ §Ú §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ, §Ü§à§ß§æ§Ú§Ô§å§â§Ú§ê§Ú§ä§Ö /etc/zabbix/zabbix_server.conf:
...
DBHost=10.211.55.9
DBName=zabbix
DBUser=zbx_srv
DBPassword=<strong_password>
DBTLSConnect=verify_ca
DBTLSCAFile=/etc/ssl/pgsql/root.crt
...
§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Þ §Ú §Ú§Õ§Ö§ß§ä§Ú§ä§Ö§ä§à§Þ §Õ§à§Þ§Ñ?§Ú§ß§Ñ §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §Ó§Ö§â§Ú§æ§Ú§Ü§Ñ§è§Ú?§Ñ §Ó§Ö§Ù§Ñ §Ú§Ù§Þ§Ö?§å Áú»¢¶Ä²© §Ü§à§â§Ú§ã§ß§Ú§é§Ü§à§Ô §Ú§ß§ä§Ö§â§æ§Ö?§ã§Ñ §Ú §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ:
§¡§Ý§ä§Ö§â§ß§Ñ§ä§Ú§Ó§ß§à, §à§Ó§à §ã§Ö §Þ§à§Ø§Ö §á§à§Õ§Ö§ã§Ú§ä§Ú §å /etc/zabbix/web/zabbix.conf.php:
$DB['ENCRYPTION'] = true;
$DB['KEY_FILE'] = '';
$DB['CERT_FILE'] = '';
$DB['CA_FILE'] = '/etc/ssl/pgsql/root.crt';
$DB['VERIFY_HOST'] = true;
$DB['CIPHER_LIST'] = '';
...
§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Þ §Ú §Ú§Õ§Ö§ß§ä§Ú§ä§Ö§ä§à§Þ §Õ§à§Þ§Ñ?§Ú§ß§Ñ §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â§Ñ §Ú §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ, §Ü§à§ß§æ§Ú§Ô§å§â§Ú§ê§Ú§ä§Ö /etc/zabbix/zabbix_server.conf: