1 MySQL encryption configuration

Overview

This section provides several encryption configuration examples for CentOS 8.2 and MySQL 8.0.21 and can be used as a quick start guide for encrypting the connection to the database. List of encryption combinations is not limited to the ones listed on this page. There are a lot more combinations available.

Since Zabbix 5.0.5, if MySQL host is set to localhost, encryption options will not be available. In this case, a connection between Zabbix frontend and the database uses a socket file (on Unix) or shared memory (on Windows) and cannot be encrypted.

Since Zabbix 5.0.5 TLS encryption parameter names in the frontend have changed slightly: for better clarity the “Database” prefix has been added. In versions 5.0.0-5.0.4 parameters are named TLS encryption, TLS certificate file, etc.

Pre-requisites

Install MySQL database from the official repository.

See MySQL documentation for details on how to use MySQL repo.

MySQL server is ready to accept secure connections using a self-signed certificate.

To see, which users are using an encrypted connection, run the following query (Performance Schema should be turned ON):

  1. mysql> SELECT sbt.variable_value AS tls_version, t2.variable_value AS cipher, processlist_user AS user, processlist_host AS host 
  2.         FROM performance_schema.status_by_thread  AS sbt
  3.         JOIN performance_schema.threads AS t ON t.thread_id = sbt.thread_id
  4.         JOIN performance_schema.status_by_thread AS t2 ON t2.thread_id = t.thread_id
  5.         WHERE sbt.variable_name = 'Ssl_version' and t2.variable_name = 'Ssl_cipher'
  6.         ORDER BY tls_version;

Required mode

MySQL configuration

Modern versions of the database are ready out-of-the-box for ‘required’ encryption mode. A server-side certificate will be created after initial setup and launch.

Create users and roles for the main components:

  1. mysql> CREATE USER   
  2.  'zbx_srv'@'%' IDENTIFIED WITH mysql_native_password BY '<strong_password>',   
  3.  'zbx_web'@'%' IDENTIFIED WITH mysql_native_password BY '<strong_password>'
  4.  REQUIRE SSL   
  5.  PASSWORD HISTORY 5; 
  7. mysql> CREATE ROLE 'zbx_srv_role', 'zbx_web_role'; 
  9. mysql> GRANT SELECT, UPDATE, DELETE, INSERT, CREATE, DROP, ALTER, INDEX, REFERENCES ON zabbix.* TO 'zbx_srv_role'; 
  10. mysql> GRANT SELECT, UPDATE, DELETE, INSERT ON zabbix.* TO 'zbx_web_role'; 
  12. mysql> GRANT 'zbx_srv_role' TO 'zbx_srv'@'%'; 
  13. mysql> GRANT 'zbx_web_role' TO 'zbx_web'@'%'; 
  15. mysql> SET DEFAULT ROLE 'zbx_srv_role' TO 'zbx_srv'@'%'; 
  16. mysql> SET DEFAULT ROLE 'zbx_web_role' TO 'zbx_web'@'%';

Note, that the X.509 protocol is not used to check identity, but the user is configured to use only encrypted connections. See MySQL documentation for more details about configuring users.

Run to check connection (socket connection cannot be used to test secure connections):

  1. $ mysql -u zbx_srv -p -h 10.211.55.9 --ssl-mode=REQUIRED

Check current status and available cipher suites:

  1. mysql> status
  2. --------------
  3. mysql Ver 8.0.21 for Linux on x86_64 (MySQL Community Server - GPL)
  5. Connection id: 62
  6. Current database:
  7. Current user: [email protected]
  8. SSL: Cipher in use is TLS_AES_256_GCM_SHA384
  11. mysql> SHOW SESSION STATUS LIKE 'Ssl_cipher_list'\G;
  12. *************************** 1. row ***************************
  13. Variable_name: Ssl_cipher_list
  14. Value: TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES256-SHA:CAMELLIA256-SHA:CAMELLIA128-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA
  15. 1 row in set (0.00 sec)
  17. ERROR:
  18. No query specified

Frontend

To enable transport-only encryption for connections between Zabbix frontend and the database:

  • Check Database TLS encryption

  • Leave Verify database certificate unchecked

Server

To enable transport-only encryption for connections between server and the database, configure /etc/zabbix/zabbix_server.conf:

  1. ...
  2. DBHost=10.211.55.9
  3. DBName=zabbix
  4. DBUser=zbx_srv
  5. DBPassword=<strong_password>
  6. DBTLSConnect=required
  7. ...

Verify CA mode

Copy required MySQL CA to the Zabbix frontend server, assign proper permissions to allow the webserver to read this file.

Frontend

To enable encryption with certificate verification for connections between Zabbix frontend and the database:

  • Check Database TLS encryption and Verify database certificate

  • Specify path to Database TLS CA file

Alternatively, this can be set in /etc/zabbix/web/zabbix.conf.php:

  1. ...
  2. $DB['ENCRYPTION'] = true;
  3. $DB['KEY_FILE'] = '';
  4. $DB['CERT_FILE'] = '';
  5. $DB['CA_FILE'] = '/etc/ssl/mysql/ca.pem';
  6. $DB['VERIFY_HOST'] = false;
  7. $DB['CIPHER_LIST'] = '';
  8. ...

Troubleshoot user using command-line tool to check if connection is possible for required user:

  1. $ mysql -u zbx_web -p -h 10.211.55.9 --ssl-mode=REQUIRED --ssl-ca=/var/lib/mysql/ca.pem

Server

To enable encryption with certificate verification for connections between Zabbix server and the database, configure /etc/zabbix/zabbix_server.conf:

  1. ...
  2. DBHost=10.211.55.9
  3. DBName=zabbix
  4. DBUser=zbx_srv
  5. DBPassword=<strong_password>
  6. DBTLSConnect=verify_ca
  7. DBTLSCAFile=/etc/ssl/mysql/ca.pem
  8. ...

Verify Full mode

MySQL configuration

Set MySQL CE server configuration option (/etc/my.cnf.d/server-tls.cnf) to:

  1. [mysqld]
  2. ...
  3. # in this examples keys are located in the MySQL CE datadir directory
  4. ssl_ca=ca.pem
  5. ssl_cert=server-cert.pem
  6. ssl_key=server-key.pem
  8. require_secure_transport=ON
  9. tls_version=TLSv1.3
  10. ...

Keys for the MySQL CE server and client (Zabbix frontend) should be created manually according to the MySQl CE documentation: Creating SSL and RSA certificates and keys using MySQL or Creating SSL certificates and keys using openssl

MySQL server certificate should contain the Common Name field set to the FQDN name as Zabbix frontend will use the DNS name to communicate with the database or IP address of the database host.

Create MySQL user:

  1. mysql> CREATE USER
  2.   'zbx_srv'@'%' IDENTIFIED WITH mysql_native_password BY '<strong_password>',
  3.   'zbx_web'@'%' IDENTIFIED WITH mysql_native_password BY '<strong_password>'
  4.   REQUIRE X509
  5.   PASSWORD HISTORY 5;

Check if it is possible to log in with that user:

  1. $ mysql -u zbx_web -p -h 10.211.55.9 --ssl-mode=VERIFY_IDENTITY --ssl-ca=/var/lib/mysql/ca.pem --ssl-cert=/var/lib/mysql/client-cert.pem --ssl-key=/var/lib/mysql/client-key.pem

Frontend

To enable encryption with full verification for connections between Zabbix frontend and the database:

  • Check Database TLS encryption and Verify database certificate

  • Specify path to Database TLS key file

  • Specify path to Database TLS CA file

  • Specify path to Database TLS certificate file

Note, that Database host verification is checked and grayed out - this step cannot be skipped for MySQL.

Cipher list should be empty, so that frontend and server can negotiate required one from the supported by both ends.

Alternatively, this can be set in /etc/zabbix/web/zabbix.conf.php:

  1. ...
  2. // Used for TLS connection with strictly defined Cipher list.
  3. $DB['ENCRYPTION'] = true;
  4. $DB['KEY_FILE'] = '/etc/ssl/mysql/client-key.pem';
  5. $DB['CERT_FILE'] = '/etc/ssl/mysql/client-cert.pem';
  6. $DB['CA_FILE'] = '/etc/ssl/mysql/ca.pem';
  7. $DB['VERIFY_HOST'] = true;
  8. $DB['CIPHER_LIST'] = 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GC';
  9. ...
  10. // or
  11. ...
  12. // Used for TLS connection without Cipher list defined - selected by MySQL server
  13. $DB['ENCRYPTION'] = true;
  14. $DB['KEY_FILE'] = '/etc/ssl/mysql/client-key.pem';
  15. $DB['CERT_FILE'] = '/etc/ssl/mysql/client-cert.pem';
  16. $DB['CA_FILE'] = '/etc/ssl/mysql/ca.pem';
  17. $DB['VERIFY_HOST'] = true;
  18. $DB['CIPHER_LIST'] = '';
  19. ...

Server

To enable encryption with full verification for connections between Zabbix server and the database, configure /etc/zabbix/zabbix_server.conf:

  1. ...
  2. DBHost=10.211.55.9
  3. DBName=zabbix
  4. DBUser=zbx_srv
  5. DBPassword=<strong_password>
  6. DBTLSConnect=verify_full
  7. DBTLSCAFile=/etc/ssl/mysql/ca.pem
  8. DBTLSCertFile=/etc/ssl/mysql/client-cert.pem
  9. DBTLSKeyFile=/etc/ssl/mysql/client-key.pem
  10. ...