NCPA connection issue

[snapon_admin]

I'm having an issue with a Windows 10 PC running the latest version of NCPA and can't figure out what the issue is. I've verified that the config is good, and I can even navigate to the NCPA web GUI for this PC, but when I run the NCPA wizard I get the below error. Does NCPA need internet access to function? This PC does not have internet access, though it is connected to the network and is pingable from the Nagios server.

Code: Select all

Unable to contact server at https://<IP>:5693/testconnect/?token=<token>.

[lmiltchev]

We haven't been able to recreate the issue in-house, so let's check a few things. What is the Nagios XI and NCPA wizard version that you are currently using?

Can you run the following command from the command line, and show the output?

Code: Select all

curl -k "https://<ip address>:5693/testconnect/?token=<token>" -v

[snapon_admin]

[root@lisl-ngos-02-pv ~]# curl -k "https://<IP>:5693/testconnect/?token=<TOKEN>" -v
* About to connect() to <IP> port 5693 (#0)
* Trying <IP>...
* Connection refused
* Failed connect to <IP>:5693; Connection refused
* Closing connection 0
curl: (7) Failed connect to <IP>:5693; Connection refused

The token does have a ! at the end. Would that cause issues?

[lmiltchev]

What is the Nagios XI and NCPA wizard version that you are currently using?

Can you rerun the check with single quotes instead of double quotes?

Code: Select all

curl -k 'https://<IP>:5693/testconnect/?token=<TOKEN>' -v

What is the output of the command below?

Code: Select all

nmap <ip address> -p 5693

The token does have a ! at the end. Would that cause issues?

I tried "!" at the end of my token, and the testconnect worked fine from the CLI. Also, the wizard worked. FYI

[jdunitz]

Having an exclamation in the token doesn't seem to cause a problem, in my testing.
However, you need to URL-encode it to test it from curl:

Code: Select all

# curl -k "https://nagiosxi:5693/testconnect/?token=t0ken!"
-bash: !": event not found
# curl -k "https://nagiosxi:5693/testconnect/?token=t0ken\!"
{
  "error": "Bad token."

So, the exclamation just confuses the shell, and if you escape it so the shell doesn't have a problem, it still doesn't get passed correctly.

URL-encoding it works:

Code: Select all

# curl -k "https://nagiosxi:5693/testconnect/?token=t0ken%21"
{
  "value": "Success."
}

URL-encoding the correct token but at the wrong port (or a port that you can't get to because of a firewall or something...) produces the error you saw:

Code: Select all

# curl -k "https://nagiosxi:5692/testconnect/?token=t0ken%21"
curl: (7) Failed connect to nagiosxi:5692; Connection refused

And pointing at the right port but with the wrong token gives you a different error:

Code: Select all

# curl -k "https://nagiosxi:5693/testconnect/?token=t00ken"
{
  "error": "Bad token."

So, I'm thinking you have a port problem of some kind. Blocked, can't get there, not listening, NCPA agent not running...perhaps one or more of those.

[snapon_admin]

Not sure where it'd be blocked. It's definitely not blocked on the network, otherwise it wouldn't have worked when i tested it with my PC. I had the operator of this PC to check the windows firewall, but he said it was already off.

[mbellerue]

It can be blocked in the config file. I know you said that the config file is good, but can you check the allowed_hosts setting in the config file? Also have you verified that the ncpa_listener service is running? I'm sorry to go low-end troubleshooting mode here, but we have covered some more complex ground without getting anywhere. Thought it would be time to go back to the basics.

Is there anything special about the network topology? Like is this Windows 10 machine on the other side of a NAT? I don't think that would cause an issue, I'm just trying to get more info. The next thing that I could think of would be to fire up Wireshark on the Windows 10 machine and see if the packets are even making it.

Or maybe send a passive service check back to the Nagios server, and see if the Nagios server receives it?

[snapon_admin]

I haven't had him send me a screenshot, but according to the site admin both services are running. There's nothing in the allowed hosts section, but there wasn't on my test PC either and that one worked fine. Allowed hosts is just commented out so I assume it's allowing any hosts. I can also connect to the NCPA GUI page when I go to https://<IP>:5693, which I assume means the services are running.

[snapon_admin]

Also sorry, NCPA version on the PC is 2.2.0.

[mbellerue]

Okay, great info, thank you! It sounds like this is going through a VPN. Is that correct? What about a proxy? If there's a proxy between the two, your browser would handle it properly, but curl and check_ncpa.py would need additional configuration to handle the proxy.