NSCA libmcrypt encryption comparable in openssl

[estebanmonge]

Hello. I can't built libmcrypt in AIX.

But I have the possibility of use openssl, I need the correct encryption for openssl. The options that AIX's openssl are:

We use 256 bit in Linux and Windows servers.

Cipher commands (see the `enc' command for more details)
aes-128-cbc aes-128-ecb aes-192-cbc aes-192-ecb aes-256-cbc
aes-256-ecb base64 bf bf-cbc bf-cfb
bf-ecb bf-ofb cast cast-cbc cast5-cbc
cast5-cfb cast5-ecb cast5-ofb des des-cbc
des-cfb des-ecb des-ede des-ede-cbc des-ede-cfb
des-ede-ofb des-ede3 des-ede3-cbc des-ede3-cfb des-ede3-ofb
des-ofb des3 desx rc2 rc2-40-cbc
rc2-64-cbc rc2-cbc rc2-cfb rc2-ecb rc2-ofb
rc4 rc4-40

Thanks

[tmcdonald]

Can you please clarify the problem you are having? It sounds like you need to use openssl in place of libmcrypt, and need to know what encryption SSL uses.

[estebanmonge]

Correct I need to replace libmcrypt with openssl, we use Rijndael with 256 bits

[tmcdonald]

Is this a specific question about Nagios Core or NSCA? AIX is a proprietary operating system that we do not have a license for, so we are unable to do any testing in such an environment.

[estebanmonge]

NSCA question

If you want test, can use any openssl implementation from Linux...

[tmcdonald]

As far as I know (and I can talk to the developer tomorrow), NSCA is written with libmcrypt in mind, and in order to use openssl you would need to make some pretty significant source code changes.

[estebanmonge]

I only need the encryption equivalent between libmcrypt rijndael and openssl aes. What combination right? I don't need any source modification or similar, only the equivalent command.

[slansing]

There is no current way to do this, you cannot currently force NSCA to configure with openssl, only mcrypt which supports 256-bit encryption. As tmcdonald mentioned above you would have to manually edit the source for send_nsca, and the nsca server on your nagios server then recompile them. This is something we cannot really help with due to the time required.

[estebanmonge]

OpenSSL supports 256 bit encryption https://www.openssl.org/docs/apps/enc.html. I going to try with aes-256-cbc

[slansing]

Yes it does support it, the issue is that mcrypt does as well, and thus mcrypt was used originally for NSCA and is hard coded in the source.