Based on the notes above, it looks like you are using CentOS6, x86_64, with the EPEL repo.
I've setup a CentOS6.5 Minimal x86_64 install for a test 'remote' system and included all steps to get a remote check_nrpe to work so you can compare to the steps you've taken.
This shouldn't be an issue with openssl in this case; even the minimal CentOS install has openssl by default (it'll get updated though when you pull in the nagios rpm's from EPEL)
If I had to guess, I'm wagering either the allowed_hosts in the nrpe.cfg isn't set to allow the nagios server, or you don't have iptables open for port 5666.
Setup notes below, so you can compare against what you've setup:
#####
note: iptables & selinux are on by default, only tcp22 is open,
localhost is in hosts file by default:
Code: Select all
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
(I only imagine this might matter when you are testing with 'localhost')
Code: Select all
yum install wget nano
wget dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
rpm -ivh epel-release-6-8.noarch.rpm
yum install -y nrpe nagios-plugins-all openssl
(pulls in about 80 packages, updates openssl)
(openssl should be installed by default, even in minimal config on centos)
Edit /etc/nagios/nrpe.cfg, default port should already be set to 5666.
Update allowed_hosts= to have localhost and nagios server IP:
Code: Select all
allowed_hosts=127.0.0.1,192.168.1.123
(assuming 192.168.1.123 is your nagios server)
Start nrpe:
(you'll want to set it to autostart)
Open iptables 5666 to nagios server (assuming 192.168.1.123 is your nagios server):
Code: Select all
/sbin/iptables -I INPUT 4 -m state --state NEW -m tcp -p tcp --dport 5666 -s 192.168.1.123 -j ACCEPT
On a default CentOS 6 install, this will make your iptables look similar to this (your nagios server IP would be different, mine was 192.168.176.41 in this sample):
Code: Select all
[root@nagiostestd ~]# /etc/init.d/iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
4 ACCEPT tcp -- 192.168.176.41 0.0.0.0/0 state NEW tcp dpt:5666
5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
6 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Save to retain on reboot:
On the remote's local console, this should now work
Code: Select all
[root@nagiostestd ~]# /usr/lib64/nagios/plugins/check_load -w 15,10,5 -c 30,20,10
OK - load average: 0.00, 0.01, 0.00|load1=0.000;15.000;30.000;0; load5=0.010;10.000;20.000;0; load15=0.000;5.000;10.000;0;
If you install the check_nrpe plugin from EPEL with:
this will also work locally at this point (the epel nrpe.cfg should already have check_load defined)
Code: Select all
[root@nagiostestd ~]# /usr/lib64/nagios/plugins/check_nrpe -H localhost -c check_load
OK - load average: 0.03, 0.02, 0.00|load1=0.030;15.000;30.000;0; load5=0.020;10.000;25.000;0; load15=0.000;5.000;20.000;0;
On the nagios server, this should work (path assumes it is also a centos6 64bit system with nagios-plugins-nrpe from EPEL):
Code: Select all
/usr/lib64/nagios/plugins/check_nrpe -H REMOTEIPHERE -c check_load
Code: Select all
[root@nagiostestA ~]# /usr/lib64/nagios/plugins/check_nrpe -H 192.168.176.44 -c check_load
OK - load average: 0.00, 0.00, 0.00|load1=0.000;15.000;30.000;0; load5=0.000;10.000;25.000;0; load15=0.000;5.000;20.000;0;
If this doesn't work, make sure you can reach port 5666 on the remote system from the nagios server.
(nmap is the easiest way to verify your open/reachable ports, replace 192.168.176.44 with your remote server IP)
Code: Select all
yum install nmap
[root@nagiostestA ~]# nmap -p 5666 192.168.176.44
Starting Nmap 5.51 ( http://nmap.org ) at 2014-02-13 21:17 CST
Nmap scan report for 192.168.176.44
Host is up (0.00074s latency).
PORT STATE SERVICE
5666/tcp open nrpe
A closed (bad) setup would look like this:
Code: Select all
[root@nagiostestA ~]# nmap -p 5666 192.168.176.44
Starting Nmap 5.51 ( http://nmap.org ) at 2014-02-13 21:23 CST
Nmap scan report for 192.168.176.44
Host is up (0.00068s latency).
PORT STATE SERVICE
5666/tcp filtered nrpe
If 5666 doesn't show open, check your iptables rules, check your port in the nrpe.cfg, verify you don't have other firewalls between your nagios server and the remote host.