NCPA - '[Errno 104] Connection reset by peer'

[nagiostra]

And run the curl command just like this and post the results:

curl -v https://192.168.64.49:5693/ -k

and the nmap command like this:

nmap 192.168.64.49:5693

[jjung_clarins]

Hello,

here's the results :

[root@xxxx~]#
[root@xxxx~]# curl -v https://xxx.xxx:5693/ -k
* About to connect() to xxx.xxxport 5693 (#0)
* Trying xxx.xxx... connected
* Connected to xxx.xxx(xxx.xxx) port 5693 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* warning: ignoring value of ssl.verifyhost
* NSS error -5961
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error
[root@xxxx~]#




[root@xxxx~]# nmap xxx.xxx

Starting Nmap 6.47 ( http://nmap.org ) at 2022-12-07 10:20 CET
Nmap scan report for xxx.xxx.com (xxx.xxx)
Host is up (0.024s latency).
Not shown: 978 closed ports
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
3389/tcp open ms-wbt-server
4343/tcp open unicall
9535/tcp open man
9593/tcp open cba8
9594/tcp open msgsys
9595/tcp open pds
33354/tcp open unknown
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49157/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 0.47 seconds
[root@xxxx~]#

[nagiostra]

On the Windows host, The nmap command's output tells us that the ncpa listener service either isn't running, or port 5693 isn't open on the firewall or you have an ssl issue. If the listener service isn't running (check your services app on the windows host) make sure that startup type is automatic and start it. If it's running, then ssl is refusing the connection. In this case, as notepad as administrator edit the file C:\Program Files (x86)\Nagios\NCPA\etc\ncpa.cfg and in the listener configuration section, change loglevel = Warning to loglevel = Debug and restart the listener service in your Services app. The next time you get the error, open C:\Program Files (x86)\Nagios\NCPA\var\log\ncpa_listener.log and post the contents. If the file has become large. just the last 20 or so lines should be sufficient.

[nagiostra]

*as notepad in notepad

[jjung_clarins]

Hello,

service is well started and i can telnet on the 5693.

No much information in the log file :
2022-12-07 17:32:33,223:INFO:ncpa_windows:Parsed config from: ['C:\\Program Files (x86)\\Nagios\\NCPA\\etc\\ncpa.cfg', 'C:\\Program Files (x86)\\Nagios\\NCPA\\etc\\ncpa.cfg.d\\example.cfg']
2022-12-07 17:32:33,223:INFO:ncpa_windows:Looking for plugins at: C:\Program Files (x86)\Nagios\NCPA\plugins
2022-12-07 17:32:33,223:INFO:ncpa_windows:Using SSL version TLSv1_2

Really Strange

[nagiostra]

It is strange indeed. The fact that it was working and then stopped working and that it's clearly an SSL issue suggests that windows update made a change to SSL. Microsoft will do that to you. Did Update run at any time around the time this behavior started? I'll keep digging.

[nagiostra]

I'm stuck on the fact that it was working and then stopped working. Clearly something changed on the Windows host. I'm happy to help but from where I'm sitting it's difficult for me to begin to know what that change might have been. Anything you can think of might help. I don't really have a next step to suggest other than uninstall/reinstalling the ncpa software.

[jjung_clarins]

Same on my side.
Already removed/reinstalled a new version of the NCPA.
Just see windows updates from today.....strange.
Must be the reason, but which one cause this and why

[nagiostra]

I'll keep digging. We'll figure it out.

[nagiostra]

Not knowing your environment I don't know if you can do this... If you can, temporarily turn off (disable) the firewall on the Windows host??