I try to use nsclient++ 0.5 with ssl whitout insecure=true.
Nagios XI side :
I compile nrpe 3.1.0 and I generate a csr to sign that certificate with our CA. I also copy the ca.crt to Nagios XI. I use that command to connect to nsclient++ on a Windows box.
Code: Select all
/usr/local/nagios/libexec/check_nrpe -H ourserver -2 -S TLSv1.2+ -L 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' -d0 -C /etc/ssl/certs/checknrpe.cer -K /etc/ssl/certs/checknrpe.key -A /etc/ssl/certs/casaq.pem -g /var/log/messages -s -1Code: Select all
[1495208869] SSL Certificate File: /etc/ssl/certs/checknrpe.cer
[1495208869] SSL Private Key File: /etc/ssl/certs/checknrpe.key
[1495208869] SSL CA Certificate File: /etc/ssl/certs/casaq.pem
[1495208869] SSL Cipher List: ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH
[1495208869] SSL Allow ADH: No
[1495208869] SSL Log Options: 0xffffffff
[1495208869] SSL Version: TLSv1_2_plus And Above
[1495208869] New SSL Cipher List: ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH:!ADH
[1495208869] Connected to 172.26.13.45
[1495208869] Error: Could not complete SSL handshake with 172.26.13.45: rc=0 SSL-error=5I install NSCP-0.5.0.65-Win32.msi on a Windows 2003 R2 32bit server. I use those parameter.
Code: Select all
[/settings/default]
; Undocumented key
password = ourpassword
; Undocumented key
allowed hosts = 127.0.0.1, 172.26.14.62, 172.26.14.63, 172.26.14.34, 172.26.14.250, 172.21.1.12
[/settings/NRPE/server]
allowed ciphers = ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH
dh =
verify mode = peer-cert
ssl options = no-sslv2,no-sslv3
; ENABLE SSL ENCRYPTION - This option controls if SSL should be enabled.
use ssl = 1
; Undocumented key
insecure = false
; PAYLOAD LENGTH - Length of payload to/from the NRPE agent. This is a hard specific value so you have to "configure" (read recompile) your NRPE agent to use the same value for it to work.
payload length = 8192
; Allow Arguements
allow arguments = true
; Allow nasty chars
allow nasty characters = true
; CA -
ca = ${certificate-path}/casaq.pem
; SSL CERTIFICATE -
certificate key = ${certificate-path}/nsclient_nopass_key.pem
; SSL CERTIFICATE -
certificate = ${certificate-path}/nsclient_cert.pem
[/settings/log/file]
; Set log file size to 10Mb
max size = 10485760
; TODO
[/modules]
; Undocumented key
CheckExternalScripts = 1
; Undocumented key
CheckHelpers = 1
; Undocumented key
CheckNSCP = 1
; Undocumented key
CheckEventLog = 1
; Undocumented key
CheckDisk = 1
; Undocumented key
CheckSystem = 1
; Undocumented key
WEBSErver = 1
; Undocumented key
NRPEServer = 1Code: Select all
2017-05-19 12:02:34: error:c:\source\nscp\include\socket/connection.hpp:257: Failed to establish secure connection: peer did not return a certificate: 199
2017-05-19 12:03:18: error:c:\source\nscp\include\socket/connection.hpp:257: Failed to establish secure connection: peer did not return a certificate: 199
