Secure the Zabbix frontend: HTTPS, firewall and first settings

All commands run on zbx01 unless the step says otherwise. Keep an SSH session open the whole time; if you make a firewall mistake you can still fix it from the VirtualBox console. The password Zbx@Secure2026 is for this lab only.

1Change the Admin password

Log in at http://zbx01.lab as Admin / zabbix. Click the user icon at the bottom of the left menu, then User settings > Profile, click Change password, enter the current password zabbix and the new one Zbx@Secure2026 twice, and click Update. Zabbix logs you out; log in again with the new password.

If you try Zbx@Admin2026 instead, you’ll see:

Cannot update user
Incorrect value for field "/1/passwd": must not contain user's name, surname or username.

The default password policy compares the new password with the username, name and surname (Admin, Zabbix, Administrator) without caring about case, so anything with “admin” in it is refused. You can see and change the rules under Users > Authentication.

✅ Checkpoint: You can log in as Admin with Zbx@Secure2026, and zabbix no longer works.

2Check that guest stays disabled

Open Users > Users and click guest. In Zabbix 8.0 the guest user is a member of the Disabled user group out of the box, so the login page has no “sign in as guest” link. Leave it that way: an enabled guest lets anyone on the network browse your monitoring without a password.

Username  Name    Surname        User role         Groups
Admin     Zabbix  Administrator  Super admin role  Internal, Zabbix administrators
guest                            Guest role        Disabled, Guests, Internal

✅ Checkpoint: Users > Users shows guest as a member of the Disabled group.

3Create a certificate with a SAN

Run this on zbx01:

sudo openssl req -x509 -newkey rsa:2048 -sha256 -days 825 -nodes \
  -keyout /etc/ssl/private/zbx01.lab.key -out /etc/ssl/certs/zbx01.lab.crt \
  -subj "/CN=zbx01.lab" \
  -addext "subjectAltName=DNS:zbx01.lab,IP:192.168.56.80"
sudo chmod 600 /etc/ssl/private/zbx01.lab.key
openssl x509 -in /etc/ssl/certs/zbx01.lab.crt -noout -subject -enddate -ext subjectAltName

You should see this (your expiry date will differ):

subject=CN=zbx01.lab
notAfter=Feb 10 06:15:21 2029 GMT
X509v3 Subject Alternative Name:
    DNS:zbx01.lab, IP Address:192.168.56.80

-nodes leaves the key without a passphrase so Nginx can start unattended, which is why the key file must be readable by root only. 825 days is the longest validity Apple devices accept for a TLS certificate. For a real server with a public name, use Let’s Encrypt with certbot --nginx or a certificate from your company CA instead.

✅ Checkpoint: The certificate lists DNS:zbx01.lab and IP Address:192.168.56.80 in its SAN.

4Switch the Nginx server block to HTTPS

Edit /etc/zabbix/nginx.conf with sudo nano. Change the listen 80; line and add the TLS lines under server_name, leaving the rest of the file (root, PHP locations) as it is:

The top of the server block should look like this:

server {
        listen          443 ssl;
        http2           on;
        server_name     zbx01.lab;

        ssl_certificate     /etc/ssl/certs/zbx01.lab.crt;
        ssl_certificate_key /etc/ssl/private/zbx01.lab.key;
        ssl_protocols       TLSv1.2 TLSv1.3;
        add_header Strict-Transport-Security "max-age=31536000" always;

        root    /usr/share/zabbix/ui;

Then add a separate file for the redirect, so port 80 answers only with a 301:

Run this on zbx01:

sudo tee /etc/nginx/conf.d/zabbix-redirect.conf >/dev/null <<'EOF'
server {
        listen 80;
        server_name zbx01.lab 192.168.56.80;
        return 301 https://zbx01.lab$request_uri;
}
EOF
sudo nginx -t && sudo systemctl reload nginx

You should see this:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

http2 on; is the form Nginx 1.25 and later use (Ubuntu 26.04 has 1.28); older guides put http2 on the listen line, which now gives a deprecation warning. The HSTS header tells browsers to use HTTPS for this name for a year, so only add it once HTTPS works.

✅ Checkpoint: nginx -t says “test is successful” and nginx reloads without errors.

5Test the redirect and TLS from zbx01

Run this on zbx01:

curl -sI http://zbx01.lab/ | head -3
curl -s -o /dev/null -w '%{http_code}\n' --cacert /etc/ssl/certs/zbx01.lab.crt https://zbx01.lab/
echo | openssl s_client -connect zbx01.lab:443 -servername zbx01.lab 2>/dev/null | grep -E '^subject=|^New,'

You should see this (your date will differ):

HTTP/1.1 301 Moved Permanently
Server: nginx/1.28.3 (Ubuntu)
Date: Sun, 08 Nov 2026 07:02:11 GMT
200
subject=CN=zbx01.lab
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384

The 301 proves port 80 redirects, the 200 proves curl trusts the certificate when given it and the name matches the SAN, and the last line shows the session uses TLS 1.3. The zbx01.lab name works on zbx01 because you added it to /etc/hosts in Lesson 1.

✅ Checkpoint: curl shows a 301 on http and a 200 on https, and openssl reports TLSv1.3.

6Trust the certificate on your laptop

Copy the certificate to your laptop: scp student@zbx01.lab:/etc/ssl/certs/zbx01.lab.crt .. On Windows, double-click it, choose Install Certificate, Current User, and place it in Trusted Root Certification Authorities. On macOS, open it in Keychain Access, then set Always Trust.

On Ubuntu desktop, copy it to /usr/local/share/ca-certificates/ and run sudo update-ca-certificates. Firefox keeps its own store: Settings > Privacy & Security > Certificates > View Certificates > Authorities > Import.

Restart the browser and open http://zbx01.lab. It should jump to https://zbx01.lab and show a padlock with no warning.

✅ Checkpoint: https://zbx01.lab opens with a padlock and no certificate warning on your laptop.

7Open only the needed ports with ufw

Run this on zbx01 (SSH rule first):

sudo ufw allow from 192.168.56.0/24 to any port 22 proto tcp
sudo ufw allow 80/tcp
sudo ufw allow from 192.168.56.0/24 to any port 443 proto tcp
sudo ufw allow from 192.168.56.0/24 to any port 10051 proto tcp comment 'Zabbix active agents and proxies'
sudo ufw enable
sudo ufw status numbered

You should see:

Rules updated
Rules updated
Rules updated (v6)
Rules updated
Rules updated
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    192.168.56.0/24
[ 2] 80/tcp                     ALLOW IN    Anywhere
[ 3] 443/tcp                    ALLOW IN    192.168.56.0/24
[ 4] 10051/tcp                  ALLOW IN    192.168.56.0/24            # Zabbix active agents and proxies
[ 5] 80/tcp (v6)                ALLOW IN    Anywhere (v6)

Each allow prints Rules updated while ufw is still off, and the 80/tcp rule adds a second IPv6 copy, hence the (v6) lines. The y/n question appears only because you’re logged in over SSH.

Your SSH session survives because rule 1 allows it. Port 80 is open to everyone only so the redirect works; the actual frontend on 443 and the trapper port 10051 accept only the lab network. Port 10050 isn’t needed on zbx01 for remote hosts, because the local agent is polled over 127.0.0.1.

✅ Checkpoint: ufw is active with rules for 22, 80, 443 and 10051, and your SSH session is still connected.

8Set the time zone and your profile

Open Administration > General > GUI and set Default time zone to (UTC+05:30) Asia/Kolkata (or yours), then click Update. Then open the user icon, User settings > Profile: set Time zone to “System default”, Refresh to 30s, Rows per page to 50, and choose a Theme you like (8.0 adds a dark blue theme next to Blue, Dark and the high-contrast ones).

Administration > General > GUI with the default time zone set to Asia/Kolkata

Check the time shown in the frontend: open Reports > System information and compare the clock at the top of a dashboard with date on zbx01. They should match to the minute.

✅ Checkpoint: Administration > General > GUI shows your time zone, and graph timestamps match the time on zbx01.

9Take a snapshot

Shut zbx01 down and take a VirtualBox snapshot called https. From now on the frontend address for the course is https://zbx01.lab.

✅ Checkpoint: zbx01 has snapshots base, zabbix-installed and https.