1 CyberArk configuration

This section explains how to configure Zabbix to retrieve secrets from CyberArk Vault CV12.

The vault should be installed and configured as described in the official CyberArk documentation.

To learn about configuring TLS in Zabbix, see Storage of secrets.

Database credentials

Access to a secret with database credentials is configured for each Zabbix component separately.

Server and proxies

To obtain database credentials from the vault for Zabbix server or proxy, specify the following configuration parameters in the configuration file:

• Vault - which vault provider should be used;
• VaultURL - vault server HTTP[S] URL;
• VaultDBPath - query to the vault secret containing database credentials which will be retrieved by keys "Content" and "UserName";
• VaultTLSCertFile, VaultTLSKeyFile - SSL certificate and key file names; setting up these options is not mandatory, but highly recommended;
• VaultPrefix - custom prefix for the vault path or query, depending on the vault; if not specified, the most suitable default will be used.

Zabbix server and Zabbix proxy read the vault-related configuration parameters from zabbix_server.conf and zabbix_proxy.conf files upon startup.

Example

1. In zabbix_server.conf, specify the following parameters:

Vault=CyberArk
       VaultURL=https://127.0.0.1:1858
       VaultDBPath=AppID=zabbix_server&Query=Safe=passwordSafe;Object=zabbix_server_database
       VaultTLSCertFile=cert.pem
       VaultTLSKeyFile=key.pem
       VaultPrefix=/AIMWebService/api/Accounts?

2. Zabbix will send the following API request to the vault:

curl \
       --header "Content type: application/json" \
       --cert cert.pem \
       --key key.pem \
       https://127.0.0.1:1858/AIMWebService/api/Accounts?AppID=zabbix_server&Query=Safe=passwordSafe;Object=zabbix_server_database

3. The vault response will contain the keys "Content" and "UserName":

{
           "Content": <password>,
           "UserName": <username>,
           "Address": <address>,
           "Database": <Database>,
           "PasswordChangeInProcess":<PasswordChangeInProcess>
       }

4. As a result, Zabbix will use the following credentials for database authentication:

• Username: <username>
• Password: <password>

Frontend

To obtain database credentials from the vault for Zabbix frontend, specify the following parameters during frontend installation.

1. At the Configure DB Connection step, set the Store credentials in parameter to "CyberArk Vault".

2. Then, fill in the additional parameters:

User macro values

To use CyberArk Vault for storing Vault secret user macro values, make sure that:

• Zabbix server is configured to work with CyberArk Vault;
• the Vault provider parameter in Administration → General → Other is set to "CyberArk Vault".

The macro value should contain a query (as query:key).

See Vault secret macros for detailed information on macro value processing by Zabbix.

Query syntax

The colon symbol (":") is reserved for separating the query from the key.

If a query itself contains a forward slash or a colon, these symbols should be URL-encoded ("/" is encoded as "%2F", ":" is encoded as "%3A").

Example

1. In Zabbix, add a user macro {$PASSWORD} of type Vault secret and with the value AppID=zabbix_server&Query=Safe=passwordSafe;Object=zabbix:Content

2. Zabbix will send the following API request to the vault:

curl \
       --header "Content type: application/json" \
       --cert cert.pem \
       --key key.pem \
       https://127.0.0.1:1858/AIMWebService/api/Accounts?AppID=zabbix_server&Query=Safe=passwordSafe;Object=zabbix_server_database

3. The vault response will contain the key "Content":

{
           "Content": <password>,
           "UserName": <username>,
           "Address": <address>,
           "Database" :<Database>,
           "PasswordChangeInProcess":<PasswordChangeInProcess>
       }

4. As a result, Zabbix will resolve the macro {$PASSWORD} to the value - <password>

Update existing configuration

To update an existing configuration for retrieving secrets from a CyberArk Vault:

1. Update the Zabbix server or proxy configuration file parameters as described in the Database credentials section.

2. Update the DB connection settings by reconfiguring Zabbix frontend and specifying the required parameters as described in the Frontend section. To reconfigure Zabbix frontend, open the frontend setup URL in the browser:

• for Apache: http://<server_ip_or_name>/zabbix/setup.php
• for Nginx: http://<server_ip_or_name>/setup.php

Alternatively, these parameters can be set in the frontend configuration file (zabbix.conf.php):

$DB['VAULT']                    = 'CyberArk';
       $DB['VAULT_URL']                = 'https://127.0.0.1:1858';
       $DB['VAULT_DB_PATH']            = 'AppID=foo&Query=Safe=bar;Object=buzz';
       $DB['VAULT_TOKEN']              = '';
       $DB['VAULT_CERT_FILE']          = 'conf/certs/cyberark-cert.pem';
       $DB['VAULT_KEY_FILE']           = 'conf/certs/cyberark-key.pem';
       $DB['VAULT_PREFIX']             = '';

3. Configure user macros as described in the User macro values section, if necessary.

To update an existing configuration for retrieving secrets from a HashiCorp Vault, see HashiCorp configuration.