Setting up a Zabbix Proxy

Zabbix is a great monitoring tool with tons of capabilities. One such capability is the use of proxies. These allow you to monitor other networks in addition to the network that your Zabbix server resides on. For example, if you run Zabbix on a VPS or dedicated server, proxies would allow you to monitor devices on your home or work network.

Preparing(Optional) Generating a Pre-Shared Key

A Zabbix proxy can communicate with the Zabbix server without using encryption, but this isn't recommended. Instead, it is best to generate a PSK and use that for encrypted communications. This will be generated on the Zabbix server then copied to the Zabbix proxy.

Installing GNU Utilities

A Pre-Shared key is required for encrypted communications between the Zabbix server and the Zabbix proxy. We will generate onethe PSK using psktool. This isn't usually included on Ubuntu Server, so install it with the following command:

sudo apt install gnutls-bin

Generating the PSK

Once installed, we will generate a new Pre-Shared Key (PSK). If you plan on setting up multiple proxies, it is best to generate a new PSK for each proxy.

psktool -u psk_identity -p zabbix002.psk -s 32

Copying the key

Due to the Pre-Shared nature of PSKs, the keyfile will need to be present on the Zabbix proxy in addition to the Zabbix server. Rsync is great for doing this.

This guide will assume that your Zabbix proxy is not accessible over the internet, so we will be using rsync to pull the zabbix002.psk from the Zabbix server.

sam@zabbix-proxy:~$ rsync "ZABBIX-SERVER-IP":zabbix002.psk zabbix002.psk

If your Zabbix server can connect to the Zabbix proxy via SSH, you can push the PSK instead:

sam@zabbix-server:~$ rsync zabbix002.psk "ZABBIX-PROXY-IP":zabbix002.psk

Installing the Zabbix proxy

Downloading the repository

First, download the Zabbix repository specific to your distribution. I'm using Ubuntu Server 20.04 (Focal) so this is the command:

wget https://repo.zabbix.com/zabbix/5.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_5.0-1+focal_all.deb

Then install using dpkg:

sudo dpkg -i zabbix-release_5.0-1+focal_all.deb

Update apt package info

sudo apt update

Install zabbix-proxy & mariadb

sudo apt install zabbix-proxy-mysql mariadb-common mariadb-server mariadb-client

Start & enable mariadb

sudo systemctl start mariadb && sudo systemctl enable mariadb

MySQL setup

Securing the installation & setting a new root DB password

sudo mysql_secure_installation
Enter current password for root (enter for none): <Press the Enter key>
Set root password? [Y/n]: Y
New password: <Enter a new root DB password>
Re-enter new password: <Repeat the new root DB password>
Remove anonymous users? [Y/n]: Y
Disallow root login remotely? [Y/n]: Y
Remove test database and access to it? [Y/n]:  Y
Reload privilege tables now? [Y/n]:  Y

Login to MySQL and create a new database & account for the Zabbix proxy

sudo mysql -uroot -p'root DB pass'
mysql> create database zabbix_proxy character set utf8 collate utf8_bin;
mysql> grant all privileges on zabbix_proxy.* to zabbix@localhost identified by 'zabbix DB pass';
mysql> quit;

Import the Zabbix database schema

zcat /usr/share/doc/zabbix-proxy-mysql*/schema.sql.gz |  mysql -uzabbix -p'zabbix DB pass' zabbix_proxy

Zabbix proxy configuration

First, open the Zabbix proxy config file with your preferred text editor (in this example nano)

sudo nano /etc/zabbix/zabbix_proxy.conf

These are the sections that we need to change:

### Option: Server
#       If ProxyMode is set to active mode:
#               IP address or DNS name of Zabbix server to get configuration data from and send data >
Server="ZABBIX-SERVER-IP"
### Option: Hostname
#       Unique, case sensitive Proxy name. Make sure the Proxy name is known to the server!
#       Value is acquired from HostnameItem if undefined.
Hostname=Zabbix proxy 002
### Option: DBPassword
#       Database password. Ignored for SQLite.
#       Comment this line if no password is used.
DBPassword=zabbix DB pass

The Zabbix proxy needs to connect to TCP port 10051 of the Zabbix server specified above. If the Zabbix server lies within a different network, you will need to create a port forwarding rule.

It is also recommended to set the ConfigFrequency parameter to 100. This will lower the amount of time that it takes the proxy to receive the configuration from the Zabbix server:

### Option: ConfigFrequency
#       How often proxy retrieves configuration data from Zabbix Server in seconds.
#       For a proxy in the passive mode this parameter will be ignored.
#
# Mandatory: no
# Range: 1-3600*24*7
# Default:
ConfigFrequency=100

If you're using a PSK, you will also need to modify these sections so that they are as follows:

### Option: TLSConnect
#       How the proxy should connect to Zabbix server. Used for an active proxy, ignored on a passive>
TLSConnect=psk
### Option: TLSAccept
#       What incoming connections to accept from Zabbix server. Used for a passive proxy, ignored on >
TLSAccept=psk
### Option: TLSPSKIdentity
#       Unique, case sensitive string used to identify the pre-shared key.
TLSPSKIdentity=zabbix002
### Option: TLSPSKFile
#       Full pathname of a file containing the pre-shared key.
TLSPSKFile=/etc/zabbix/zabbix002.psk

Moving the PSK

SSH into the Zabbix proxy, and move the zabbix PSK that we copied earlier to /etc/zabbix:

sam@zabbix-proxy:~$ sudo mv zabbix002.psk /etc/zabbix/

Make Zabbix the owner of the PSK:

sam@zabbix-proxy:~$ sudo chown zabbix:zabbix /etc/zabbix/zabbix002.psk

Set the correct permissions for the PSK:

sam@zabbix-proxy:~$ sudo chmod 644 /etc/zabbix/zabbix002.psk

Starting and enabling the Zabbix proxy service

Now that the configuration file has been modified and the PSK has been moved to the desired location, we can finally start and enable the Zabbix-proxy service using these commands:

sudo systemctl restart zabbix-proxy && sudo systemctl enable zabbix-proxy

Registering the Proxy in the Zabbix web interface

The Zabbix proxy service is now running, and will be trying to connect to the Zabbix server via it's IP address on TCP port 10051.