Le Goût du Libre

These instructions make the assumption :

• You have a Debian 12 “vanilla” setup, only SSH server and no desktop environment
• No root account, all commands are run as sudo - this usually starts with sudo -s after login.
• Zabbix server is NOT Internet-facing, and runs in a LAN, isolated environment

For an Internet-facing install, consider setting up an SSL certificate with certbot, and configuring two-factor authentication (2FA).

Full official documentation is available at Zabbix.com.

• Fabian Rodríguez, François Baillargeon (review) - Le Goût du Libre
• Sources:
  • Official Zabbix installation instructions
  • Debian Zabbix insstallation instructions

Set up en_US.UTF-8 as default locale and add additional locales (French and Spanish shown here) for multi-language support in Zabbix:

# 1. Uncomment desired locale(s) in /etc/locale.gen
sed -i 's/^# *\(en_US.UTF-8 UTF-8\)/\1/' /etc/locale.gen
sed -i 's/^# *\(fr_FR.UTF-8 UTF-8\)/\1/' /etc/locale.gen
sed -i 's/^# *\(es_ES.UTF-8 UTF-8\)/\1/' /etc/locale.gen

# 2. Generate the locales
locale-gen

# 3. Set system-wide default locale
update-locale LANG=en_US.UTF-8

# 4. restart the apache2 service
service apache2 restart

For more information about Zabbix language support, see the project documentation.

Install the default MariaDB server package:

apt install default-mysql-server

Run as root to improve database security:

mariadb-secure-installation

Answer 'n' to the first two questions, assuming you have no root account setup.

Download and install official Zabbix APT package - whis will add Zabbix repositories to your servers', and update the repositories database:

wget https://repo.zabbix.com/zabbix/7.4/release/debian/pool/main/z/zabbix-release/zabbix-release_latest_7.4+debian12_all.deb
dpkg -i zabbix-release_latest_7.4+debian12_all.deb
apt update

Install server, frontend (PHP), Apache configuration, SQL scripts, and agent:

apt install zabbix-server-mysql zabbix-frontend-php zabbix-apache-conf zabbix-sql-scripts zabbix-agent

Connect to MariaDB and create database/user:

mysql -uroot -p

(press enter as your root user is not defined)

Important : The second statement should be changed to use a password of your choice.

create database zabbix character set utf8mb4 collate utf8mb4_bin;
create user zabbix@localhost identified by 'password';
grant all privileges on zabbix.* to zabbix@localhost;
set global log_bin_trust_function_creators = 1;
quit;

Import initial schema:

zcat /usr/share/zabbix/sql-scripts/mysql/server.sql.gz | mysql --default-character-set=utf8mb4 -uzabbix -p zabbix

Disable trust function flag after import:

mysql -uroot -p

set global log_bin_trust_function_creators = 0;
quit;

Set the database password in /etc/zabbix/zabbix_server.conf (replace with the password set in step 6 above):

DBPassword=password

Start and enable server, agent, and Apache:

systemctl restart zabbix-server zabbix-agent apache2
systemctl enable zabbix-server zabbix-agent apache2

Open Zabbix frontend in a browser to test the installation has completed well (don't finish it just yet, SSL setup is next!):

http://your-server-ip/zabbix

Using SSL in a LAN environment helps protect sensitive data like login credentials from being intercepted or tampered with—even on internal networks where threats can arise from compromised devices or curious users.

While self-signed certificates aren't trusted publicly, they're perfectly acceptable in closed systems where you control the environment and trust the endpoints.

Create directory:

sudo mkdir -p /etc/ssl/zabbix

Generate cert:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/zabbix/zabbix.key -out /etc/ssl/zabbix/zabbix.crt -subj "/C=CA/ST=Quebec/L=Boisbriand/O=ZabbixLAN/CN=zabbix.local"

Enable SSL module and default SSL site:

sudo a2enmod ssl
sudo a2ensite default-ssl

Edit SSL virtual host:

sudo nano /etc/apache2/sites-available/default-ssl.conf

Update config:

SSLEngine on
SSLCertificateFile /etc/ssl/zabbix/zabbix.crt
SSLCertificateKeyFile /etc/ssl/zabbix/zabbix.key
DocumentRoot /usr/share/zabbix

This prevents accidentally using http (plain-text) to connect to your server.

Edit HTTP virtual host:

sudo nano /etc/apache2/sites-available/000-default.conf

Add inside <VirtualHost *:80>:

Redirect "/" "https://your-server-ip/"

Replace your-server-ip with your actual IP or hostname.

Restart Apache:

sudo systemctl restart apache2

Use:

https://your-server-ip/zabbix

Accept the browser warning for the self-signed certificate.

The default access credentials are :

• User : Admin
• Password : zabbix