====Zabbix 4.0 LTS on CentOS 7====

For around 100 hosts to monitor use 2 cores, 2GB RAM and 40G space.

Install CentOS 7 minimal, enable NTPD, set static IP (use your internal DNS servers if wanting to resolve by internal hostnames..) and a fqdn that you will add to your DNS system later. If using multiple NICS to monitor multiple networks, add a gateway only to the NIC that can access other networks (this is typically not your management LAN or other isolated networks)

  - Reboot and perform a yum update + install vim then reboot again...
<code>
yum update && yum install vim
shutdown -r now
</code>


===Create sudo User + Disable root SSH Access===

Create user with password
<code>
useradd sudo_username && passwd sudo_username
</code>

Add user to wheel group for sudo privileges
<code>
usermod -aG wheel sudo_username
</code>

Log out of root and into newly created account.

Disable root login over SSH
<code>
sudo vim /etc/ssh/sshd_config
</code>

Add line
<code>
PermitRootLogin no
</code>


Restart sshd
<code>
sudo systemctl restart sshd
</code>

Configure your hosts file with your fqdn
<code>
sudo vim /etc/hosts
</code>
Add something like:
<code>
10.254.157.147 zabbix.domain.com zabbix 
</code>

===Configure Firewall===
<code>
sudo firewall-cmd --permanent --zone=public --add-port=80/tcp
sudo firewall-cmd --permanent --zone=public --add-port=443/tcp
sudo firewall-cmd --reload
sudo systemctl daemon-reload
</code>

===Install Fail2ban===

This will help prevent the baddies from brute forcing your SSH password...

Install epel repo, install fail2ban and enable it
<code>
sudo yum install epel-release
sudo yum install fail2ban
sudo systemctl enable fail2ban
</code>

Create a jail for sshd
<code>sudo vim /etc/fail2ban/jail.d/sshd.local</code>

Add as follows:
<code>
[sshd]
enabled = true
port = ssh
action = iptables-multiport
logpath = /var/log/secure
maxretry = 5
bantime = 3600
</code>

Restart fail2ban
<code>sudo systemctl restart fail2ban</code>

===Install Dependancies and Utils===

<code>
sudo yum install wget mariadb-server httpd policycoreutils-python
</code>

==Secure Mariadb==
<code>
sudo systemctl enable mariadb
sudo systemctl start mariadb
</code>
Secure the MariaDB install
<code>
sudo mysql_secure_installation
</code>

==Install PHP 7.3==
<code>
sudo yum install epel-release
wget http://rpms.remirepo.net/enterprise/remi-release-7.rpm
sudo rpm -Uvh remi-release-7.rpm
sudo yum install yum-utils
sudo yum-config-manager --enable remi-php73
sudo yum --enablerepo=remi-php73 install php
</code>

Search for available modules
<code>
yum --enablerepo=remi-php73 search php | grep php73
</code>

Install modules
<code>
sudo yum --enablerepo=remi-php73 install php-gd php-bcmath php-ctype php-xml php-xmlreader php-xmlwriter php-session php-mysqlnd php-mbstring php-gettext php-ldap php-mysqli php-pecl-mysql
</code>

Edit php.ini to set some variables...
<code>
sudo vim /etc/php.ini
</code>

Set the following variables as such
<code>
post_max_size = 16M
max_execution_time = 300
max_input_time = 300
date.timezone = America/Los_Angeles
</code>
ofc use your own time zone...


===Install and configure Zabbix===
https://www.zabbix.com/download?zabbix=4.0&os_distribution=red_hat_enterprise_linux&os_version=7&db=mysql

a. Install Zabbix repository
documentation
<code>
sudo rpm -Uvh https://repo.zabbix.com/zabbix/4.0/rhel/7/x86_64/zabbix-release-4.0-1.el7.noarch.rpm
sudo yum clean all
</code>
b. Install Zabbix server, frontend, agent
<code>
sudo yum install zabbix-server-mysql zabbix-web-mysql zabbix-agent
</code>
c. Create initial database
documentation
<code>
sudo mysql -uroot -p
password
create database zabbix character set utf8 collate utf8_bin;
grant all privileges on zabbix.* to zabbix@localhost identified by 'password';
quit;
</code>
Import initial schema and data. You will be prompted to enter your newly created password.
<code>
sudo zcat /usr/share/doc/zabbix-server-mysql*/create.sql.gz | mysql -u zabbix -p zabbix
</code>
d. Configure the database for Zabbix server

Edit file /etc/zabbix/zabbix_server.conf
<code>
DBPassword=password
e. Configure PHP for Zabbix frontend
Edit file /etc/httpd/conf.d/zabbix.conf, uncomment and set the right timezone for you.
# php_value date.timezone Europe/Riga
f. Start Zabbix server and agent processes
</code>

Fix SELinux permissions

https://www.zabbix.com/forum/zabbix-help/367261-selinux-and-zabbix




Start Zabbix server and agent processes and make it start at system boot:

<code>
sudo systemctl restart zabbix-server zabbix-agent httpd
sudo systemctl enable zabbix-server zabbix-agent httpd
</code>

<code>
sudo grep httpd_t /var/log/audit/audit.log | audit2allow -M httpd_custom
sudo semodule -i httpd_custom.pp
sudo systemctl restart zabbix-server zabbix-agent httpd
</code>
Now your Zabbix server is up and running!

Configure Zabbix frontend
Connect to your newly installed Zabbix frontend: http://server_ip_or_name/zabbix 

Go through step, the default username is Admin (case sensitive) and the password is zabbix.

Fix a systemd issue where zabbix server won't shutdown. It should be fixed in a later release as it was being discussed on 06/15/19. Note: this fix might corrupt the database during updates so change it back to TimeoutSec=0 before doing any upgrades.

Edit the systemd file
<code>
vim /etc/systemd/system/multi-user.target.wants/zabbix.server.service
</code>
Change the line to match as follows
<code>
TimeoutSec=60s
</code>


https://www.zabbix.com/documentation/4.0/manual/installation/requirements/best_practices

==== Best practices for secure Zabbix setup ====

=== Overview ===

This section contains best practices that should be observed in order to set up Zabbix in a secure way.

The practices contained here are not required for the functioning of Zabbix. They are recommended for better security of the system.

=== Principle of least privilege ===

The principle of least privilege should be used at all times for Zabbix. This principle means that user accounts (in Zabbix frontend) or process user (for Zabbix server/proxy or agent) have only those privileges that are essential to perform intended functions. In other words, user accounts at all times should run with as few privileges as possible.

<note important>Giving extra permissions to 'zabbix' user will allow it to access configuration files and execute operations that can compromise the overall security of infrastructure.</note>

When implementing the least privilege principle for user accounts, Zabbix [[:manual/config/users_and_usergroups/permissions|frontend user types]] should be taken into account. It is important to understand that while a %%"%%Zabbix Admin%%"%% user type has less privileges than %%"%%Zabbix Super Admin%%"%% user type, it has administrative permissions that allow managing configuration and execute custom scripts.

<note>Some information is available even for non-privileged users. For example, while //Administration// -> //Scripts// is not available for non-Super Admins, scripts themselves are available for retrieval by using Zabbix API. Limiting script permissions and not adding sensitive information (like access credentials, etc) should be used to avoid exposure of sensitive information available in global scripts.</note>

=== Secure user for Zabbix agent ===

In the default configuration, Zabbix server and Zabbix agent processes share one 'zabbix' user. If you wish to make sure that the agent cannot access sensitive details in server configuration (e.g. database login information), the agent should be run as a different user:

  - Create a secure user
  - Specify this user in the agent [[:manual/appendix/config/zabbix_agentd|configuration file]] ('User' parameter)
  - Restart the agent with administrator privileges. Privileges will be dropped to the specified user.

=== UTF-8 encoding ===

UTF-8 is the only encoding supported by Zabbix. It is known to work without any security flaws. Users should be aware that there are known security issues if using some of the other encodings.

=== Setting up SSL for Zabbix frontend ===

On RHEL/Centos, install mod_ssl package:

  yum install mod_ssl
  
Create directory for SSL keys:

  mkdir -p /etc/httpd/ssl/private
  chmod 700 /etc/httpd/ssl/private

Create SSL certificate:

  openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/httpd/ssl/private/apache-selfsigned.key -out /etc/httpd/ssl/apache-selfsigned.crt

Fill out the prompts appropriately. The most important line is the one that requests the Common Name. You need to enter the domain name that you want to be associated with your server. You can enter the public IP address instead if you do not have a domain name. We will use //example.com// in this article.

  Country Name (2 letter code) [XX]:
  State or Province Name (full name) []:
  Locality Name (eg, city) [Default City]:
  Organization Name (eg, company) [Default Company Ltd]:
  Organizational Unit Name (eg, section) []:
  Common Name (eg, your name or your server's hostname) []:example.com
  Email Address []:

Edit Apache SSL configuration:

  /etc/httpd/conf.d/ssl.conf

  DocumentRoot "/usr/share/zabbix"
  ServerName example.com:443
  SSLCertificateFile /etc/httpd/ssl/apache-selfsigned.crt
  SSLCertificateKeyFile /etc/httpd/ssl/private/apache-selfsigned.key

Restart the Apache service to apply the changes:

  systemctl restart httpd.service
  
=== Enabling Zabbix on root directory of URL ===

Add a virtual host to Apache configuration and set permanent redirect for document root to Zabbix SSL URL. Do not forget to replace //example.com// with the actual name of the server.

  /etc/httpd/conf/httpd.conf

<code>
#Add lines

<VirtualHost *:*>
    ServerName example.com
    Redirect permanent / http://example.com
</VirtualHost>
</code>

Restart the Apache service to apply the changes:

  systemctl restart httpd.service

=== Enabling HTTP Strict Transport Security (HSTS) on web server ===

[[https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security|HSTS]] is enforced by Zabbix frontend in versions 4.0.0 - 4.0.2.

Starting with **4.0.3** to protect Zabbix frontend against protocol downgrade attacks, we recommend to enable [[https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security|HSTS]] policy on webserver.

For example, to enable HSTS policy for your Zabbix frontend in Apache configuration:

  /etc/httpd/conf/httpd.conf

add the following directive to your virtual host's configuration:

<code>
<VirtualHost *:443>
   Header set Strict-Transport-Security "max-age=31536000"
</VirtualHost>
</code>

Restart the Apache service to apply the changes:

  systemctl restart httpd.service

=== Disabling web server information exposure ===

It is recommended to disable all web server signatures as part of the web server hardening process. The web server is exposing software signature by default:

{{:manual:installation:requirements:software_signature.png|}}

The signature can be disabled by adding two lines to the Apache (used as an example) configuration file:

  ServerSignature Off
  ServerTokens Prod

PHP signature (X-Powered-By HTTP header) can be disabled by changing the php.ini configuration file (signature is disabled by default):

  expose_php = Off
  
Web server restart is required for configuration file changes to be applied.

Additional security level can be achieved by using the mod_security (package libapache2-mod-security2) with Apache. mod_security allows to remove server signature instead of only removing version from server signature. Signature can be altered to any value by changing "SecServerSignature" to any desired value after installing mod_security.

Please refer to documentation of your web server to find help on how to remove/change software signatures.

=== Disabling default web server error pages ===

It is recommended to disable default error pages to avoid information exposure. Web server is using built-in error pages by default:

{{:manual:installation:requirements:error_page_text.png|}}

Default error pages should be replaced/removed as part of the web server hardening process. The "ErrorDocument" directive can be used to define a custom error page/text for Apache web server (used as an example).

Please refer to documentation of your web server to find help on how to replace/remove default error pages.

=== Removing web server test page ===

It is recommended to remove the web server test page to avoid information exposure. By default, web server webroot contains a test page called index.html (Apache2 on Ubuntu is used as an example):

{{:manual:installation:requirements:test_page.png|}}

The test page should be removed or should be made unavailable as part of the web server hardening process.