Page 1 of 2

AES encryption for NSCA

Posted: Wed Nov 18, 2015 8:28 am
by WillemDH
I'm trying to prepare my environment for migration to NSClient++ 0.4.4 or higher (from 0.4.1.105)

The default encryption method suggested by Michael Medin for NSCA is aes.

Code: Select all

[/settings/NSCA/client/targets/default]
encryption = aes
In the nsca.cfg on the Nagios server however I only find:

Code: Select all

# DECRYPTION METHOD
# This option determines the method by which the nsca daemon will
# decrypt the packets it receives from the clients.  The decryption
# method you choose will be a balance between security and performance,
# as strong encryption methods consume more processor resources.
# You should evaluate your security needs when choosing a decryption
# method.
#
# Note: The decryption method you specify here must match the
#       encryption method the nsca clients use (as specified in
#       the send_nsca.cfg file)!!
# Values:
#
#       0 = None        (Do NOT use this option)
#       1 = Simple XOR  (No security, just obfuscation, but very fast)
#
#       2 = DES
#       3 = 3DES (Triple DES)
#       4 = CAST-128
#       5 = CAST-256
#       6 = xTEA
#       7 = 3WAY
#       8 = BLOWFISH
#       9 = TWOFISH
#       10 = LOKI97
#       11 = RC2
#       12 = ARCFOUR
#
#       14 = RIJNDAEL-128
#       15 = RIJNDAEL-192
#       16 = RIJNDAEL-256
#
#       19 = WAKE
#       20 = SERPENT
#
#       22 = ENIGMA (Unix crypt)
#       23 = GOST
#       24 = SAFER64
#       25 = SAFER128
#       26 = SAFER+
#
Is aes encryption supported on the Nagios NSCA side? If yes, what number am I supposed to configure in nsca.cfg?

Re: AES encryption for NSCA

Posted: Wed Nov 18, 2015 5:12 pm
by tmcdonald

Re: AES encryption for NSCA

Posted: Wed Nov 18, 2015 5:44 pm
by WillemDH
Ah, so if I put 16 it should work with "encryption = aes" in nsclient.ini?

Re: AES encryption for NSCA

Posted: Wed Nov 18, 2015 5:56 pm
by tmcdonald
14, 15, or 16 depending on what bit-size it's using on the NSClient side I believe.

Re: AES encryption for NSCA

Posted: Tue Mar 01, 2016 5:01 pm
by WillemDH
Trevor,

I tried setting it to 16 in /usr/local/nagios/etc/nsca.cfg and to aes in my NSClient config file, but my nsca real-time events didn't arrive in XI. I did see them with tcpdump on port 5667. When I try another encryption, such as des, or blowfish it does work.
Could someone try to reproduce. I'm using NSClient++ 0.5.0.23.

Code: Select all

[/settings/NSCA/client]
hostname = hostname
channel = NSCA

[/settings/NSCA/client/targets/default]
address = <ip>
allowed ciphers = ADH
use ssl = 0
timeout = 30
retries = 3
encryption = aes
password = password
verify mode = none
This is non urgent.

Grtz

Willem

Re: AES encryption for NSCA

Posted: Wed Mar 02, 2016 12:21 pm
by tmcdonald
I tend to believe this is an NSClient issue. I just tested 14, 15, and 16 in nsca.cfg using the send_nsca binary on the XI system, with matching values set in send_nsca.cfg and all three came in just fine:

Code: Select all

echo -e "testhost\t0\thello\n" | ./send_nsca -H localhost -c ../etc/send_nsca.cfg
1 data packet(s) sent to host successfully.
That's how I was testing, and it came through immediately. I can have someone test with NSClient if you'd like, but I trust your judgment and I think it should be brought up to Mr. Medin.

Re: AES encryption for NSCA

Posted: Wed Mar 02, 2016 12:49 pm
by ssax
I was only able to get NSClient++ working with 14 (AES-128). 15 (AES-192) and 16 (AES-256) do not work in NSClient++. I also confirmed that all AES algorithms work for the Linux client as well.

Re: AES encryption for NSCA

Posted: Wed Mar 02, 2016 1:41 pm
by WillemDH
Thanks all the testing. I'll also check if 14 does work one of these days. If I can confirm Sean's findings I'll make a bug report on GitHub for it. Chrz!

Re: AES encryption for NSCA

Posted: Wed Mar 02, 2016 2:30 pm
by ssax
I should clarify that when I said "I also confirmed that all AES algorithms work for the Linux client as well.", I meant the send_nsca client.

Re: AES encryption for NSCA

Posted: Thu Apr 14, 2016 5:36 am
by WillemDH
Made https://github.com/mickem/nscp/issues/287

Let's see what Michael says.