Áú»¢¶Ä²©

1 CyberArk configuration

This section explains how to configure Áú»¢¶Ä²© to retrieve secrets from CyberArk Vault CV12.

The vault should be installed and configured as described in the official .

To learn about configuring TLS in Áú»¢¶Ä²©, see Storage of secrets.

Database credentials

Access to a secret with database credentials is configured for each Áú»¢¶Ä²© component separately.

Server and proxies

To obtain database credentials from the vault for Áú»¢¶Ä²© server or proxy, specify the following configuration parameters in the configuration file:

• Vault - which vault provider should be used;
• VaultURL - vault server HTTP[S] URL;
• VaultDBPath - query to the vault secret containing database credentials which will be retrieved by keys "Content" and "UserName" (this option can only be used if DBUser and DBPassword are not specified);
• VaultTLSCertFile, VaultTLSKeyFile - SSL certificate and key file names; setting up these options is not mandatory, but highly recommended;
• VaultPrefix - custom prefix for the vault path or query, depending on the vault; if not specified, the most suitable default will be used.

Áú»¢¶Ä²© server and Áú»¢¶Ä²© proxy read the vault-related configuration parameters from zabbix_server.conf and zabbix_proxy.conf files upon startup.

Example

1. In zabbix_server.conf, specify the following parameters:

Vault=CyberArk
       VaultURL=https://127.0.0.1:1858
       VaultDBPath=AppID=zabbix_server&Query=Safe=passwordSafe;Object=zabbix_server_database
       VaultTLSCertFile=cert.pem
       VaultTLSKeyFile=key.pem
       VaultPrefix=/AIMWebService/api/Accounts?

2. Áú»¢¶Ä²© will send the following API request to the vault:

curl \
       --header "Content type: application/json" \
       --cert cert.pem \
       --key key.pem \
       https://127.0.0.1:1858/AIMWebService/api/Accounts?AppID=zabbix_server&Query=Safe=passwordSafe;Object=zabbix_server_database

3. The vault response will contain the keys "Content" and "UserName":

{
           "Content": <password>,
           "UserName": <username>,
           "Address": <address>,
           "Database": <Database>,
           "PasswordChangeInProcess":<PasswordChangeInProcess>
       }

4. As a result, Áú»¢¶Ä²© will use the following credentials for database authentication:

• Username: <username>
• Password: <password>

Frontend

To obtain database credentials from the vault for Áú»¢¶Ä²© frontend, specify the following parameters during frontend installation.

1. At the Configure DB Connection step, set the Store credentials in parameter to "CyberArk Vault".

2. Then, fill in the additional parameters:

User macro values

To use CyberArk Vault for storing Vault secret user macro values, make sure that:

• Áú»¢¶Ä²© server is configured to work with CyberArk Vault;
• the Vault provider parameter in Administration → General → Other is set to "CyberArk Vault".

The macro value should contain a query (as query:key).

See Vault secret macros for detailed information on macro value processing by Áú»¢¶Ä²©.

Query syntax

The colon symbol (":") is reserved for separating the query from the key.

If a query itself contains a forward slash or a colon, these symbols should be URL-encoded ("/" is encoded as "%2F", ":" is encoded as "%3A").

Example

1. In Áú»¢¶Ä²©, add a user macro {$PASSWORD} of type Vault secret and with the value AppID=zabbix_server&Query=Safe=passwordSafe;Object=zabbix:Content

2. Áú»¢¶Ä²© will send the following API request to the vault:

curl \
       --header "Content type: application/json" \
       --cert cert.pem \
       --key key.pem \
       https://127.0.0.1:1858/AIMWebService/api/Accounts?AppID=zabbix_server&Query=Safe=passwordSafe;Object=zabbix_server_database

3. The vault response will contain the key "Content":

{
           "Content": <password>,
           "UserName": <username>,
           "Address": <address>,
           "Database" :<Database>,
           "PasswordChangeInProcess":<PasswordChangeInProcess>
       }

4. As a result, Áú»¢¶Ä²© will resolve the macro {$PASSWORD} to the value - <password>

Update existing configuration

To update an existing configuration for retrieving secrets from a CyberArk Vault:

1. Update the Áú»¢¶Ä²© server or proxy configuration file parameters as described in the Database credentials section.

2. Update the DB connection settings by reconfiguring Áú»¢¶Ä²© frontend and specifying the required parameters as described in the Frontend section. To reconfigure Áú»¢¶Ä²© frontend, open the frontend setup URL in the browser:

• for Apache: http://<server_ip_or_name>/zabbix/setup.php
• for Nginx: http://<server_ip_or_name>/setup.php

Alternatively, these parameters can be set in the frontend configuration file (zabbix.conf.php):

$DB['VAULT']                    = 'CyberArk';
       $DB['VAULT_URL']                = 'https://127.0.0.1:1858';
       $DB['VAULT_DB_PATH']            = 'AppID=foo&Query=Safe=bar;Object=buzz';
       $DB['VAULT_TOKEN']              = '';
       $DB['VAULT_CERT_FILE']          = 'conf/certs/cyberark-cert.pem';
       $DB['VAULT_KEY_FILE']           = 'conf/certs/cyberark-key.pem';
       $DB['VAULT_PREFIX']             = '';

3. Configure user macros as described in the User macro values section, if necessary.

To update an existing configuration for retrieving secrets from a HashiCorp Vault, see HashiCorp configuration.