Add {TLSCipher}* options for proxy/server
MODIFY
manifests/init.pp
manifests/init.pp
@@ -161,6 +161,12 @@ class zabbix (
$tlscertfile = $zabbix::params::server_tlscertfile,
$tlscrlfile = $zabbix::params::server_tlscrlfile,
$tlskeyfile = $zabbix::params::server_tlskeyfile,
+ $tlscipherall = $zabbix::params::server_tlscipherall,
+ $tlscipherall13 = $zabbix::params::server_tlscipherall13,
+ $tlsciphercert = $zabbix::params::server_tlsciphercert,
+ $tlsciphercert13 = $zabbix::params::server_tlsciphercert13,
+ $tlscipherpsk = $zabbix::params::server_tlscipherpsk,
+ $tlscipherpsk13 = $zabbix::params::server_tlscipherpsk13,
$trappertimeout = $zabbix::params::server_trappertimeout,
$unreachableperiod = $zabbix::params::server_unreachableperiod,
$unavailabledelay = $zabbix::params::server_unavailabledelay,
@@ -295,6 +301,12 @@ class zabbix (
tlscertfile => $tlscertfile,
tlscrlfile => $tlscrlfile,
tlskeyfile => $tlskeyfile,
+ tlscipherall => $tlscipherall,
+ tlscipherall13 => $tlscipherall13,
+ tlsciphercert => $tlsciphercert,
+ tlsciphercert13 => $tlsciphercert13,
+ tlscipherpsk => $tlscipherpsk,
+ tlscipherpsk13 => $tlscipherpsk13,
trappertimeout => $trappertimeout,
unreachableperiod => $unreachableperiod,
unavailabledelay => $unavailabledelay,

MODIFY
manifests/params.pp
manifests/params.pp
@@ -279,6 +279,12 @@ class zabbix::params {
$server_tlscertfile = undef
$server_tlscrlfile = undef
$server_tlskeyfile = undef
+ $server_tlscipherall = undef
+ $server_tlscipherall13 = undef
+ $server_tlsciphercert = undef
+ $server_tlsciphercert13 = undef
+ $server_tlscipherpsk = undef
+ $server_tlscipherpsk13 = undef
$server_tmpdir = '/tmp'
$server_trappertimeout = '300'
$server_trendcachesize = '4M'
@@ -322,16 +328,16 @@ class zabbix::params {
$agent_tlsaccept = undef
$agent_tlscafile = undef
$agent_tlscertfile = undef
+ $agent_tlsconnect = undef
+ $agent_tlscrlfile = undef
+ $agent_tlskeyfile = undef
+ $agent_tlspskfile = undef
$agent_tlscipherall = undef
$agent_tlscipherall13 = undef
$agent_tlsciphercert = undef
$agent_tlsciphercert13 = undef
$agent_tlscipherpsk = undef
$agent_tlscipherpsk13 = undef
- $agent_tlsconnect = undef
- $agent_tlscrlfile = undef
- $agent_tlskeyfile = undef
- $agent_tlspskfile = undef
$agent_tlspskidentity = undef
$agent_tlsservercertissuer = undef
$agent_tlsservercertsubject = undef
@@ -440,6 +446,12 @@ class zabbix::params {
$proxy_tlscrlfile = undef
$proxy_tlskeyfile = undef
$proxy_tlspskfile = undef
+ $proxy_tlscipherall = undef
+ $proxy_tlscipherall13 = undef
+ $proxy_tlsciphercert = undef
+ $proxy_tlsciphercert13 = undef
+ $proxy_tlscipherpsk = undef
+ $proxy_tlscipherpsk13 = undef
$proxy_tlspskidentity = undef
$proxy_tlsservercertissuer = undef
$proxy_tlsservercertsubject = undef

MODIFY
manifests/proxy.pp
manifests/proxy.pp
@@ -432,6 +432,12 @@ class zabbix::proxy (
$tlskeyfile = $zabbix::params::proxy_tlskeyfile,
$tlspskfile = $zabbix::params::proxy_tlspskfile,
$tlspskidentity = $zabbix::params::proxy_tlspskidentity,
+ Optional[String[1]] $tlscipherall = $zabbix::params::proxy_tlscipherall,
+ Optional[String[1]] $tlscipherall13 = $zabbix::params::proxy_tlscipherall13,
+ Optional[String[1]] $tlsciphercert = $zabbix::params::proxy_tlsciphercert,
+ Optional[String[1]] $tlsciphercert13 = $zabbix::params::proxy_tlsciphercert13,
+ Optional[String[1]] $tlscipherpsk = $zabbix::params::proxy_tlscipherpsk,
+ Optional[String[1]] $tlscipherpsk13 = $zabbix::params::proxy_tlscipherpsk13,
$tlsservercertissuer = $zabbix::params::proxy_tlsservercertissuer,
$tlsservercertsubject = $zabbix::params::proxy_tlsservercertsubject,
$trappertimeout = $zabbix::params::proxy_trappertimeout,

MODIFY
manifests/server.pp
manifests/server.pp
# [*tlskeyfile*]
# Full pathname of a file containing the server private key.
#
+# [*tlscipherall*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for certificate- and PSK-based encryption.
+#
+# [*tlscipherall13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for certificate- and PSK-based encryption.
+#
+# [*tlsciphercert*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for certificate-based encryption.
+#
+# [*tlsciphercert13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for certificate-based encryption.
+#
+# [*tlscipherpsk*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for PSK-based encryption.
+#
+# [*tlscipherpsk13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for PSK-based encryption.
+#
# [*trappertimeout*]
# Specifies how many seconds trapper may spend processing new data.
#
@@ -373,6 +397,12 @@ class zabbix::server (
$tlscertfile = $zabbix::params::server_tlscertfile,
$tlscrlfile = $zabbix::params::server_tlscrlfile,
$tlskeyfile = $zabbix::params::server_tlskeyfile,
+ Optional[String[1]] $tlscipherall = $zabbix::params::server_tlscipherall,
+ Optional[String[1]] $tlscipherall13 = $zabbix::params::server_tlscipherall13,
+ Optional[String[1]] $tlsciphercert = $zabbix::params::server_tlsciphercert,
+ Optional[String[1]] $tlsciphercert13 = $zabbix::params::server_tlsciphercert13,
+ Optional[String[1]] $tlscipherpsk = $zabbix::params::server_tlscipherpsk,
+ Optional[String[1]] $tlscipherpsk13 = $zabbix::params::server_tlscipherpsk13,
$trappertimeout = $zabbix::params::server_trappertimeout,
$unreachableperiod = $zabbix::params::server_unreachableperiod,
$unavailabledelay = $zabbix::params::server_unavailabledelay,

MODIFY
spec/classes/proxy_spec.rb
spec/classes/proxy_spec.rb
@@ -275,7 +275,13 @@ describe 'zabbix::proxy' do
vmwarefrequency: '60',
zabbix_server_host: '192.168.1.1',
zabbix_server_port: '10051',
- zabbix_version: '5.0'
+ zabbix_version: '5.0',
+ tlsciphercert: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlsciphercert13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlscipherpsk: 'kECDHEPSK+AES128:kPSK+AES128',
+ tlscipherpsk13: 'TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128'
}
end
@@ -343,6 +349,12 @@ describe 'zabbix::proxy' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^SSLCALocation=/usr/lib/zabbix/ssl/certs} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^LoadModulePath=\$\{libdir\}/modules$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^LoadModule=pizza$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherCert=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherCert13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherPSK=kECDHEPSK\+AES128:kPSK\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherPSK13=TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherAll=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherAll13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128:kECDHEPSK\+AES128:kPSK\+AES128$} }
end
context 'with zabbix_proxy.conf and version 4.0' do

MODIFY
spec/classes/server_spec.rb
spec/classes/server_spec.rb
@@ -260,7 +260,13 @@ describe 'zabbix::server' do
valuecachesize: '4M',
vmwarecachesize: '8M',
vmwarefrequency: '60',
- zabbix_version: '5.0'
+ zabbix_version: '5.0',
+ tlsciphercert: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlsciphercert13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlscipherpsk: 'kECDHEPSK+AES128:kPSK+AES128',
+ tlscipherpsk13: 'TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128'
}
end
@@ -327,6 +333,12 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^ValueCacheSize=4M} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^VMwareCacheSize=8M} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^VMwareFrequency=60} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherCert=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherCert13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherPSK=kECDHEPSK\+AES128:kPSK\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherPSK13=TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherAll=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherAll13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128:kECDHEPSK\+AES128:kPSK\+AES128$} }
end
context 'with zabbix_server.conf and version 5.0' do

MODIFY
templates/zabbix_proxy.conf.erb
templates/zabbix_proxy.conf.erb
@@ -563,3 +563,77 @@ LoadModulePath=<%= @loadmodulepath %>
# Default:
<% if @database_tlscipher13 %>DBTLSCipher13=<%= @database_tlscipher13 %><% end %>
<% end %>
+
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: TLSCipherCert13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+#
+# Mandatory: no
+# Default:
+# TLSCipherCert13=
+<% if @tlsciphercert13 %>TLSCipherCert13=<%= @tlsciphercert13 %><% end %>
+
+### Option: TLSCipherCert
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherCert=
+<% if @tlsciphercert %>TLSCipherCert=<%= @tlsciphercert %><% end %>
+
+### Option: TLSCipherPSK13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example:
+# TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+# TLSCipherPSK13=
+<% if @tlscipherpsk13 %>TLSCipherPSK13=<%= @tlscipherpsk13 %><% end %>
+
+### Option: TLSCipherPSK
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL
+# Example for OpenSSL:
+# kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherPSK=
+<% if @tlscipherpsk %>TLSCipherPSK=<%= @tlscipherpsk %><% end %>
+
+### Option: TLSCipherAll13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example:
+# TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+# TLSCipherAll13=
+<% if @tlscipherall13 %>TLSCipherAll13=<%= @tlscipherall13 %><% end %>
+
+### Option: TLSCipherAll
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherAll13=
+<% if @tlscipherall %>TLSCipherAll=<%= @tlscipherall %><% end %>
+
+<% end %>
+

MODIFY
templates/zabbix_server.conf.erb
templates/zabbix_server.conf.erb
@@ -516,3 +516,76 @@ LoadModulePath=<%= @loadmodulepath %>
# Default:
<% if @database_tlscipher13 %>DBTLSCipher13=<%= @database_tlscipher13 %><% end %>
<% end %>
+
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: TLSCipherCert13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+#
+# Mandatory: no
+# Default:
+# TLSCipherCert13=
+<% if @tlsciphercert13 %>TLSCipherCert13=<%= @tlsciphercert13 %><% end %>
+
+### Option: TLSCipherCert
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherCert=
+<% if @tlsciphercert %>TLSCipherCert=<%= @tlsciphercert %><% end %>
+
+### Option: TLSCipherPSK13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example:
+# TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+# TLSCipherPSK13=
+<% if @tlscipherpsk13 %>TLSCipherPSK13=<%= @tlscipherpsk13 %><% end %>
+
+### Option: TLSCipherPSK
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL
+# Example for OpenSSL:
+# kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherPSK=
+<% if @tlscipherpsk %>TLSCipherPSK=<%= @tlscipherpsk %><% end %>
+
+### Option: TLSCipherAll13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example:
+# TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+# TLSCipherAll13=
+<% if @tlscipherall13 %>TLSCipherAll13=<%= @tlscipherall13 %><% end %>
+
+### Option: TLSCipherAll
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherAll13=
+<% if @tlscipherall %>TLSCipherAll=<%= @tlscipherall %><% end %>
+
+<% end %>

Add {TLSCipher}* options for proxy/server