lmiltchev wrote:Let's try this one more time. Stop the iptables on the client:
Make sure that 127.0.0.1 IP has been added to the "/etc/xinetd.d/nrpe":
Code: Select all
grep "127.0.0.1" /etc/xinetd.d/nrpe
Code: Select all
/usr/local/nagios/libexec/check_nrpe -H localhost -p 5666
/usr/local/nagios/libexec/check_nrpe -H 127.0.0.1 -p 5666
/usr/local/nagios/bin/nrpe -V
cat /etc/hosts.allow
cat /etc/hosts.deny
Code: Select all
/usr/local/nagios/libexec/check_nrpe -H 10.10.82.38
nmap 10.10.82.38 -p 5666
Hi..
Seems like things are in the same shape.
Please find the output:
Output from the Client serveR:
[root@uusrcpmwik00 libexec]# service iptables stop
iptables: Setting chains to policy ACCEPT: filter mangle na[ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
[root@uusrcpmwik00 libexec]# grep "127.0.0.1" /etc/xinetd.d/nrpe
only_from = 127.0.0.1 10.10.83.90
[root@uusrcpmwik00 libexec]# /usr/local/nagios/libexec/check_nrpe -H localhost -p 5666
connect to address ::1 port 5666: Connection refused
connect to address 127.0.0.1 port 5666: Connection refused
connect to host localhost port 5666: Connection refused[root@uusrcpmwik00 libexec]#
[root@uusrcpmwik00 libexec]# /usr/local/nagios/libexec/check_nrpe -H 127.0.0.1 -p 5666
connect to address 127.0.0.1 port 5666: Connection refused
connect to host 127.0.0.1 port 5666: Connection refused[root@uusrcpmwik00 libexec]#
[root@uusrcpmwik00 libexec]# /usr/local/nagios/bin/nrpe -V
NRPE - Nagios Remote Plugin Executor
Copyright (c) 1999-2008 Ethan Galstad (
[email protected])
Version: 2.15
Last Modified: 09-06-2013
License: GPL v2 with exemptions (-l for more info)
SSL/TLS Available: Anonymous DH Mode, OpenSSL 0.9.6 or higher required
***************************************************************
** POSSIBLE SECURITY RISK - COMMAND ARGUMENTS ARE SUPPORTED! **
** Read the NRPE SECURITY file for more information **
***************************************************************
***************************************************************
** POSSIBLE SECURITY RISK - TCP WRAPPERS ARE NOT AVAILABLE! **
** Read the NRPE SECURITY file for more information **
***************************************************************
Usage: nrpe [-n] -c <config_file> [-4|-6] <mode>
Options:
-n = Do not use SSL
<config_file> = Name of config file to use
-4 = use ipv4 only
-6 = use ipv6 only
<mode> = One of the following operating modes:
-i = Run as a service under inetd or xinetd
-d = Run as a standalone daemon
-d -s = Run as a subsystem under AIX
Notes:
This program is designed to process requests from the check_nrpe
plugin on the host(s) running Nagios. It can run as a service
under inetd or xinetd (read the docs for info on this), or as a
standalone daemon. Once a request is received from an authorized
host, NRPE will execute the command/plugin (as defined in the
config file) and return the plugin output and return code to the
check_nrpe plugin.
[root@uusrcpmwik00 libexec]# cat /etc/hosts.allow
#
# hosts.allow This file contains access rules which are used to
# allow or deny connections to network services that
# either use the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
#
# See 'man 5 hosts_options' and 'man 5 hosts_access'
# for information on rule syntax.
# See 'man tcpd' for information on tcp_wrappers
#
[root@uusrcpmwik00 libexec]# cat /etc/hosts.deny
#
# hosts.deny This file contains access rules which are used to
# deny connections to network services that either use
# the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
#
# The rules in this file can also be set up in
# /etc/hosts.allow with a 'deny' option instead.
#
# See 'man 5 hosts_options' and 'man 5 hosts_access'
# for information on rule syntax.
# See 'man tcpd' for information on tcp_wrappers
#
Output on Nagios XI server:
[root@lussvpnagiosxi00 libexec]# /usr/local/nagios/libexec/check_nrpe -H 10.10.82.38
connect to address 10.10.82.38 port 5666: Connection refused
connect to host 10.10.82.38 port 5666: Connection refusedYou have new mail in /var/spool/mail/root
[root@lussvpnagiosxi00 libexec]#
[root@lussvpnagiosxi00 libexec]# nmap 10.10.82.38 -p 5666
Starting Nmap 5.51 (
http://nmap.org ) at 2015-08-04 13:46 CDT
Nmap scan report for 10.10.82.38
Host is up (0.00038s latency).
PORT STATE SERVICE
5666/tcp closed nrpe
Nmap done: 1 IP address (1 host up) scanned in 13.12 seconds
[root@lussvpnagiosxi00 libexec]#