it is on the same server.
I just edited:
sudo ​vi /etc/zabbix/zabbix_server.conf
and set :
DBhost=​localhost

I did enter the real IP address.

sudo mysql -u zabbix -p -h xx.xx.14.212​
Enter password:
ERROR 2005 (HY000): Unknown MySQL server host 'xx.xx.14.212​' (0)

@coliver I think % is the wildcard from what I read. Not good practice, but I was trying to get it working.

MariaDB [(none)]> show grants for [email protected]​;
ERROR 1141 (42000): There is no such grant defined for user 'zabbix' on host 'xx.xx.14.212​'
MariaDB [(none)]> show grants for zabbix
-> ;
+-------------------------------------------------------------------------------------------------------+
| Grants for zabbix@% |
+-------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON . TO 'zabbix'@'%' IDENTIFIED BY PASSWORD 'F7B59hashhereC9667D7D09DC' |
| GRANT ALL PRIVILEGES ON zabbix. TO 'zabbix'@'%' |
+-------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)

Do I have too many zabbix users configured? Should I just have the one with the external host IP?

When I run it, I get:
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> show grants for [email protected]​; ERROR 1141 (42000): There is no such grant defined for user 'zabbix' on host 'xx.xx.14.212​'

Do the single quotes matter when running these commands?

Shouldn't this work:

GRANT ALL PRIVILEGES ON zabbix.* TO zabbix@​xx.xx.14.212 IDENTIFIED BY 'mySecurePasswordHere​';

I think we have a bingo.

ERROR 1141 (42000): There is no such grant defined for user 'zabbix' on host 'xx.xx.14.212​'

database on the same server. If I log in to the database, and run:
select user, host from mysql.user;
it returns:
MariaDB [(none)]> select user, host from mysql.user;
+--------+--------------------+
| user | host |
+--------+--------------------+
| zabbix | % |
| root | 127.0.0.1 |
| root | ::1 |
| root | localhost |
| zabbix | localhost |
| zabbix | ​xx.xx.14.212​ |
+--------+--------------------+
6 rows in set (0.00 sec)

when I run:
sudo getenforce
it returns:
Disabled

Do I need to enable it so those rules apply?

The guide I was following said to run these commands:
sudo setsebool -P httpd_can_network_connect=1
sudo setsebool -P httpd_can_connect_zabbix=1
sudo setsebool -P zabbix_can_network=1

from the /var/log/zabbix/zabbix_server.log file:
] Access denied for user 'zabbix'@'xx.xx.14.212' (using password: YES)
1141:20161020:143621.388 cannot set MySQL character set to "utf8"
1141:20161020:143621.388 database is down: reconnecting in 10 seconds

First let me say that I have very little experience with linux, so I'm probably missing something obvious. I built a Zabbix server on CentOS. It seemed to be working and I went through the initial web config. Then I went to configuration and Hosts and enabled the Zabbix server. As far as I remember everything was green in the dashboard, so I downloaded an agent, installed it on a Windows box and pointed it towards my Zabbix server. I went back to the dashboard and at the bottom it's saying "Zabbix server is not running: the information displayed may not be current."

I ran this to see if the zabbix service was running:

systemctl status zabbix-server -l

output
● zabbix-server.service - Zabbix Server
Loaded: loaded (/usr/lib/systemd/system/zabbix-server.service; enabled; vendor preset: disabled)
Active: active (running) since Thu 2016-10-20 05:03:48 UTC; 9h ago
Process: 1112 ExecStart=/usr/sbin/zabbix_server -c $CONFFILE (code=exited, status=0/SUCCESS)
Main PID: 1141 (zabbix_server)
CGroup: /system.slice/zabbix-server.service
└─1141 /usr/sbin/zabbix_server -c /etc/zabbix/zabbix_server.conf

Oct 20 05:03:48 vny-lnx-zabbix systemd[1]: Starting Zabbix Server...
Oct 20 05:03:48 vny-lnx-zabbix systemd[1]: PID file /run/zabbix/zabbix_server.pid not readable (yet?) after start.
Oct 20 05:03:48 vny-lnx-zabbix systemd[1]: Started Zabbix Server.
Oct 20 05:08:58 vny-lnx-zabbix systemd[1]: Started Zabbix Server.

In the county where I work most, 40% of jobs are government jobs of some sort. This includes teachers, police, elected officials, etc. That is the population that knows only "spend it or lose it".

I don't know how the credit card industry works. All I know is that for the clients of mine that use a PoS and the ones that have a IP based credit card machine, they both get sent the same form. For the PoS running on Windows, I totally understand. For the self contained machine, it makes no sense.

@scottalanmiller said in EdgeRouter X for small office with PCI compliance:

@Mike-Davis said in EdgeRouter X for small office with PCI compliance:

I'm sure you've filled out the PCI compliance form where they ask if your wifi is using WPA2 and all that. I'd like to be able to just rip down through the form and say N/A for everything. I agree that it's silly to think that it's more vulnerable on your LAN than going across the internet.

Wouldn't it be N/A in either case? What's the purpose of the PCI form if not for security?

The purpose of the form is to shift liability. If you check that you're using WPA2, and credit card numbers are stolen, and they find out you were using WEP, you are liable.

@Breffni-Potter not a bad laptop except for needing a dongle for ethernet and VGA. I mean a dongle? really?

If that doesn't matter to you. It's a nice thin and light laptop. The keyboard has a nice feel to it as well. You can also dock it, which is cool.

I'm sure you've filled out the PCI compliance form where they ask if your wifi is using WPA2 and all that. I'd like to be able to just rip down through the form and say N/A for everything. I agree that it's silly to think that it's more vulnerable on your LAN than going across the internet.

If your sharepoint server is on its own VM, and the only roles on your DC are the cert services, I would build a new DC migrate your FSMO roles over and back up the old DC. Then shutdown the old DC and listen for the screams. If you hear nothing after a week or so power it back up and demote it.

@scottalanmiller said in Migrate and/or replace old cert server?:

And uses certs for that?

yes. I've done it that way.

@Dashrender said in Migrate and/or replace old cert server?:

When did he say there was no service associated with it?

I think that was from me saying there wasn't a service that you could shutdown. I meant under windows services, there isn't one for certificate services that you can stop.