エラー内容
正しいユーザ名・パスワードを入力しても、以下エラーが表示されログインできない。
Incorrect user name or password or account is temporarily blocked.
解決策
postgresqlデータベースから、Adminユーザのパスワードをzabbixに初期化し、再度ログインする。
# psql -U zabbix
=> UPDATE users SET passwd = '$2a$10$ZXIvHAEP2ZM.dLXTm6uPHOMVlARXX7cqjbhM6Fn0cANzkCQBWpMrS' WHERE username = 'Admin';
=> \q
環境
OS: almalinux-release-8.8-1.el8.x86_64
Zabbix Server: zabbix-server-pgsql-4.0.50-1.el8.x86_64
→ zabbix-server-pgsql-7.0.8-release1.el8.x86_64
Database: postgresql-server-15.10-1.module_el8.10.0+3929+38258aa5.x86_64
原因
Zabbix 6.2からパスワード暗号化に使用されていたMD5ハッシュがbcryptに置き換わり、結果として過去バージョンからバージョンアップ後にパスワード情報が利用できなくなりました。
Secure password hashing
In Zabbix 5.0 the password hashing algorithm was changed from MD5 to the more secure bcrypt. However, MD5 cryptography remained supported to ensure smooth upgrades from previous versions. MD5 hashing was only used for some users upon the first login after an upgrade - to convert passwords with not reliable hashes from MD5 to bcrypt. Now support of MD5 cryptography has been dropped completely.
バージョン間で比較するとpasswd列の内容が揮発していることが確認できます。
zabbix=> select * from users;
userid | alias | name | surname | passwd | url | autologin | autologout | lang | refresh | type | theme | attempt_failed | attempt_ip | attempt_clock | rows_per_page
--------+-------+--------+---------------+----------------------------------+-----+-----------+------------+-------+---------+------+---------+----------------+---------------+---------------+---------------
1 | Admin | Zabbix | Administrator | 5fce1b3e34b520afeffb37ce08c7cd66 | | 1 | 0 | ja_JP | 60s | 3 | default | 0 | 192.168.142.1 | 1727960176 | 100
2 | guest | | | d41d8cd98f00b204e9800998ecf8427e | | 0 | 15m | en_GB | 30s | 1 | default | 0 | | 0 | 50
zabbix=> select * from users;
userid | username | name | surname | passwd | url | autologin | autologout | lang | refresh | theme | attempt_failed | attempt_ip | attempt_clock | rows_per_page | timezone | roleid | userdirectoryid | ts_provisioned
--------+----------+--------+---------------+--------+-----+-----------+------------+---------+---------+---------+----------------+------------+---------------+---------------+----------+--------+-----------------+----------------
1 | Admin | Zabbix | Administrator | | | 1 | 0 | ja_JP | 30s | default | 0 | | 0 | 50 | default | 3 | | 0
2 | guest | | | | | 0 | 15m | default | 30s | default | 0 | | 0 | 50 | default | 1 | | 0
そのため、対処としてbcryptで変換されたデフォルトパスワードをテーブルに直接書き込むことで事象が改善します。
zabbix=> UPDATE users SET passwd = '$2a$10$ZXIvHAEP2ZM.dLXTm6uPHOMVlARXX7cqjbhM6Fn0cANzkCQBWpMrS' WHERE username = 'Admin';
UPDATE 1
zabbix=> select * from users;
userid | username | name | surname | passwd | url | autologin | autologout | lang | refresh | theme | attempt_failed | attempt_ip | attempt_clock | rows_per_page | timezone | roleid | userdirectoryid | ts_provisioned
--------+----------+--------+---------------+--------------------------------------------------------------+-----+-----------+------------+---------+---------+---------+----------------+---------------+---------------+---------------+----------+--------+-----------------+----------------
2 | guest | | | | | 0 | 15m | default | 30s | default | 0 | | 0 | 50 | default | 1 | | 0
1 | Admin | Zabbix | Administrator | $2a$10$ZXIvHAEP2ZM.dLXTm6uPHOMVlARXX7cqjbhM6Fn0cANzkCQBWpMrS | | 1 | 0 | ja_JP | 30s | default | 2 | 192.168.142.1 | 1737875295 | 50 | default | 3 | | 0
参考