Nagios Support Forum

We're currently using the Nagios XI product in a proof of principle mode. I need to defend our design choices on Tuesday.

We're running the Nagios XI server in HTTPS mode, with TCP wrappers, firewalls and SSL-ADH encryption for the NRPE client.

Went through the FAQs and reviewed the documents that came with the product; have some questions.

==

I found running the NRPE client with no parameter passing made the Nagios XI product not really usefull. Is that a correct interpretation? I don't see how parameterless NRPE can be used effectively.

I have to enable dont_blame_nrpe=1; Any guidance on how to more securely implement the NRPE client?

Any methods to further harden the NRPE client? Has anyone implemented randomly restarting the NRPE daemon to pickup a new seed to further harden SSL-ADH encryption?

The CVE-2014-2913 covers this exploit. It's disputed. Would you have any info on why it's disputed?

Command injection via the NRPE client
http://seclists.org/fulldisclosure/2014/Apr/240

And thanks much for your thoughts.

This is trivial to answer. What is the reason that NRPE is useless without parameter passing? What cannot be achieved by hard coding parameters? If the problem is scalability it just becomes a matter of orchestrating config file centralization and/or deployment.

The fact that you're already SSL encrypting NRPE client means you've already greatly reduced your attack surface area, honestly with that I'm not sure how you'd exploit NRPE arguments. Either way, disabling them and configuring them at the client is absolutely trivial and really answers all the questions you asked, right?