Home » Categories » Multiple Categories

Disabling Port 113 IDENT Requests

Problem Description

You are seeing port 113 return requests either from your Nagios XI server (when submitting NSCA passive results) to the originating host OR you are seeing port 113 return requests when checking NRPE services).

You will see this behaviour on your firewall logs as you will most likely not have a firewall rule for port 113.

 

 

Explanation

This is usually because you are running an NRPE check through XINETD with USERID included on the log_on_success or log_on_failure options in your remote hosts /etc/xinetd.d/nrpe file.

OR this could be because you are submitting passive results to the XI server through NSCA (which is running under XINETD) /etc/xinetd.d/nsca with the same options as above.

Further information can be found in the following link:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Reference_Guide/s2-tcpwrappers-xinetd-alt.html#s3-tcpwrappers-xinetd-alt-log

Note that the USERID option requires an IDENT request to port 113 on the originating server to determine the USERID, that's why you're seeing it.

 

Resolution

Then remove the USERID option from the log_on_failure AND log_on_success to stop the IDENT from occurring. The file you need to change depends on:

  • NRPE on remote host
    • /etc/xinetd.d/nrpe
  • NSCA on Nagios XI server
    • /etc/xinetd.d/nsca

For example, either comment this line out or remove it completely:

# default: on
# description: NSCA (Nagios Service Check Acceptor)
service nsca
{
           flags = REUSE
           socket_type = stream        
           wait = no
           user = nagios
           group = nagios
           server = /usr/local/nagios/bin/nsca
           server_args = -c /usr/local/nagios/etc/nsca.cfg --inetd
           log_on_failure += USERID
           disable = no
           only_from = 127.0.0.1
}

 

After making the changes you need to restart the xinetd service using one of the commands below:

RHEL 6 | CentOS 6 | Oracle Linux 6 | Ubuntu 14

service xinetd restart

 

RHEL 7 | CentOS 7 | Oracle Linux 7 | Debian | Ubuntu 16/18

systemctl restart xinetd.service

 

 

 

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/

0 (0)
Article Rating (No Votes)
Rate this article
  • Icon PDFExport to PDF
  • Icon MS-WordExport to MS Word
Attachments Attachments
There are no attachments for this article.
Related Articles RSS Feed
Nagios XI - Notifications Not Sending In XI 5.3.0
Viewed 697 times since Tue, Oct 4, 2016
Nagios XI - MRTG Reports SNMP_Session Errors
Viewed 691 times since Wed, Jul 27, 2016
Nagios XI - 2014 Upgrade Issue - CONFIG ERROR
Viewed 683 times since Mon, Jan 25, 2016
CHECK_NRPE: Error - Could not connect to xxx.xxx.xxx.xxx: Connection reset by peer
Viewed 5900 times since Fri, Jul 14, 2017
NRPE - NRPE: Unable To Read Output
Viewed 13215 times since Mon, Jul 17, 2017
Nagios XI - Resolving "Cannot connect to database" Error - Core Config Manager
Viewed 962 times since Mon, Jan 25, 2016
Nagios XI - Reset Upgrade Status In Web Interface
Viewed 1660 times since Tue, May 7, 2019
Nagios XI - Running Out Of Disk Space On The Nagios XI VM
Viewed 2736 times since Tue, Jan 27, 2015
Nagios XI - Defining Global Environment Variables
Viewed 1562 times since Thu, Mar 17, 2016
Nagios XI - Problems Using Nagios XI With Proxies
Viewed 2493 times since Mon, Jan 25, 2016