Nagios XI + nsclient++

[ssax]

Non-standard buffer length (hope you have recompiled check_nrpe changing #define MAX_PACKETBUFFER_LENGTH = 8192

Please try commenting out this line in your nsclient.ini under the [/settings/NRPE/server] section and restart the nsclient++ service, test it again, and send the output again:

Code: Select all

;payload length = 1024

---

For future readers, this is how it is initially setup:

- Note: It's up to you to adjust allow arguments and/or allow nasty characters in the nsclient.ini per your business requirements

*** Make sure that you have known-good backups/vm snapshots before making any modifications just in case you need to revert and try it on a test system first.

https://assets.nagios.com/downloads/nag ... ios-XI.pdf

1. Install NRPE maint branch on the nagios XI server:

Code: Select all

cd /tmp
wget https://github.com/NagiosEnterprises/nrpe/archive/maint.zip
unzip maint.zip
cd nrpe-maint
./configure
make all
make install

Then validate that the version is upgraded with this command:

Code: Select all

[root@ssc66xid nrpe-maint]# /usr/local/nagios/libexec/check_nrpe -V

NRPE Plugin for Nagios
Copyright (c) 1999-2008 Ethan Galstad ([email protected])
Version: 3.1.0
Last Modified: 2017-04-19
License: GPL v2 with exemptions (-l for more info)
SSL/TLS Available: OpenSSL 0.9.6 or higher required

2. Edit your nsclient.ini on the remote machine and set:

Code: Select all

[/settings/NRPE/server]
allowed ciphers = ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH
ca = ${certificate-path}/ca_cert.pem
certificate = ${certificate-path}/client_cert.pem
certificate key = ${certificate-path}/client_cert.key
dh =
verify mode = peer-cert
ssl options = no-sslv2,no-sslv3

; COMMAND ALLOW NASTY META CHARS - This option determines whether or not the we will allow clients to specify nasty (as in |`&><'"\[]{}) characters in arguments.
allow nasty characters = 0

; COMMAND ARGUMENT PROCESSING - This option determines whether or not the we will allow clients to specify arguments to commands that are executed.
allow arguments = 1

 ; ENABLE SSL ENCRYPTION - This option controls if SSL should be enabled.
use ssl = 1

; ALLOW INSECURE CHIPHERS and ENCRYPTION - Only enable this if you are using legacy check_nrpe client.
insecure = false

3. Add these files on your nsclient.ini server:

Code: Select all

NSCLIENT_INSTALL_DIRECTORY\security\ca_cert.pem

NSCLIENT_INSTALL_DIRECTORY\security\client_cert.pem

NSCLIENT_INSTALL_DIRECTORY\security\client_cert.key

Code: Select all

ca_cert.pem     <- This is your CA certificate (not the private key) and every CA certificate of the chain will need to be in there.

client_cert.pem   <- This is your NSClient++ server's certificate (without the private key).

client_cert.key    <- This is your NSClient++ server's private key for the certificate.

4. Restart the NSClient++ service.


5. Test from your XI server:
- Change the paths and X.X.X.X as neccessary

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H X.X.X.X -2 -S TLSv1.2+ -L 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' -d0 -C /path/to/your/xiserver.crt -K /path/to/your/xiserver_private.key -A /path/to/your/ca_cert.pem -g /var/log/messages -s-1

Code: Select all

/path/to/your/xiserver.crt          <- XI server's certificate (without private key)

/path/to/your/xiserver_private.key      <- XI server's private key

/path/to/your/ca_cert.pem                    <- This is the same file as the one in step 3.

Run that command and then look at the output of this command on the XI server:

Code: Select all

tail -n200 /var/log/messages

And from the nsclient.log on the remote server.

To enable debugging on the remote server you can adjust your [/settings/log] section:

Code: Select all

; LOG SECTION - Configure log properties.
[/settings/log]

; FILENAME - The file to write log data to. Set this to none to disable log to file.
file name = ${exe-path}/nsclient.log

; DATEMASK - The size of the buffer to use when getting messages this affects the speed and maximum size of messages you can recieve.
date format = %Y-%m-%d %H:%M:%S

; LOG LEVEL - Log level to use. Available levels are error,warning,info,debug,trace
level = trace

Thank you

[bennyboy]

Can you help me to understand how to use a real valid certificate with NSCLIENT ? Do I have to use the same certificate on both NRPE and NSCLIENT ?

Thank you!

[ssax]

When you say "a real valid certificate" are you just saying using your internal CA (or an external CA) to issue the certificates?

The general process is the same:
- Generate the CSR and private key on the XI server and the NSClient++ server
- Have your CA admins issue the certs and install them in the same locations on the XI server and the NSClient++ server
- Add all of your CA certificates (you must have the full certificate chain in there if you have multiple CAs or an offline root ca) into the ca_cert.pem file on both machines
- Restart the services and use the new certs

The only real difference is that the certs will be different (issued by your CA) and the ca_cert.pem file will have all of your internal/external CA certs in it instead of the ones that were generated on the XI server.

Let me know if you have any questions.


Thank you

[bennyboy]

What is the criteria of check_nrpe to identify the nsclient certificate as invalid ???

Code: Select all

[1495228341] SSL Certificate File: /etc/ssl/certs/checknrpe.cer
[1495228341] SSL Private Key File: /etc/ssl/certs/checknrpe.key
[1495228341] SSL CA Certificate File: /etc/ssl/certs/casaq.pem
[1495228341] SSL Cipher List: ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH
[1495228341] SSL Allow ADH: No
[1495228341] SSL Log Options: 0xffffffff
[1495228341] SSL Version: TLSv1_2_plus And Above
[1495228341] New SSL Cipher List: ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH:!ADH
[1495228341] Connected to 172.26.13.45
[1495228341] Remote 172.26.13.45 - SSL Version: TLSv1.2
[1495228341] Remote 172.26.13.45 - TLSv1/SSLv3, Cipher is AES256-GCM-SHA384

[1495228341] SSL 172.26.13.45 has an invalid certificate

Code: Select all

[1495228341] SSL 172.26.13.45 Cert Name: /C=BLAH/ST=BLAH/L=MTL/O=BLAH/OU=IT/CN=blah.domain.com/[email protected]
[1495228341] SSL 172.26.13.45 Cert Issuer: /DC=blah/DC=blah/DC=blah/CN=CA

[ssax]

This is a bug and can safely be ignored, if you are forcing the certs and you get data, it's working properly, please see here:

https://github.com/NagiosEnterprises/nrpe/issues/123

Thank you

[bennyboy]

It`s working if I comment verify mode = peer-cert if I reenable that option it`s not working.
When I comment that it's working but I see a message about check_nrpe see nsclient as an invalid certificate ...

[ssax]

Did you enable trace logging in your nsclient.ini?

Please restart the nsclient++ service, run the check again a few times, and then send me the entire nsclient.log file from the remote machine.

Please attach a sanitized copy of your nsclient.ini as well.


Thank you