Home » Categories » Multiple Categories

OpenSSL causes issue with check_nrpe plugin with NSClient++

The Problem

The new openssl package on the latest versions of Centos / RHEL/ Ubuntu / Debian cause compatibility issues that cause the check_nrpe plugin to fail when checking Windows Hosts running NSClient++.

Error Displayed

CHECK_NRPE: (ssl_err != 5) Error - Could not complete SSL handshake with xxx.xxx.xxx.xxx: 1

Error in the nsclient.log file

Failed to establish secure connection: sslv3 alert handshake failure: 1040

Solution

To fix this, do the following:

1. Generate DH key on the new Nagios server. (It will take a long time to generate so be patient)

openssl dhparam -C 2048 2> /dev/null|sed -n '/BEGIN/,/END/p'

The below is an example of the output:

-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEAsT8ZYluOSVjB67zI8HXRzAjVRsBGLktGbUm7Zfhtn5dYTMaEjSRx
+7McBGnmoJa9ty54UE/5/8rM1CFvA5VyEOakZHemTNvAofB40ZmEhgANVmbHZxtr
egvj4svxnvFM4gAfpsSe2C8DVbXXEJlUVfyacbfb4f9ko0l62XsTEQJGWGRxXca7
b66g5MY6eYxihavufmZmZPw4ZnBPEpoGpH2GKZ0obOEfACTrV01p+CbiVDJ9lpc7
KOxbXA+3nV5LRMSjlz83RuDdQ3QLcQQQ7cpWKEzAlHO/AO4BRqthmSBkTVWNeHoO
a4PNgZO2xdnLHJuK75YQJeLAOKI9xVgaCwIBAg==
-----END DH PARAMETERS-----

2. Paste the DH key to a new file "nrpe_dh_2048.pem" on the Windows server in the following location:

C:\Program Files\NSClient++\security\nrpe_dh_2048.pem

3. Open a command prompt in Windows (under user with admin privileges) and run these commands:

cd "\Program Files\NSClient++"
nscp settings --path /settings/NRPE/server --key dh --set "${certificate-path}/nrpe_dh_2048.pem"

Or add the below under the [/settings/NRPE/server] section in the C:\Program Files\NSClient++\nsclient.ini file:

; DH KEY -
dh = ${certificate-path}/nrpe_dh_2048.pem

4. Restart NSClient++ service

net stop nscp && net start nscp

Test it:

/usr/local/nagios/libexec/check_nrpe -H xxx.xxx.xxx.xxx -2

I (0.5.0.62 2016-09-14) seem to be doing fine...

0 (0)
Article Rating (No Votes)
Rate this article
  • Icon PDFExport to PDF
  • Icon MS-WordExport to MS Word
Attachments Attachments
There are no attachments for this article.
Related Articles RSS Feed
Nagios XI - Scheduled Downtime Not Working
Viewed 3726 times since Mon, Oct 10, 2016
Nagios XI - Hosts Pending/Gray
Viewed 6613 times since Tue, Jan 6, 2015
Nagios XI - Scheduled Backup Log Level
Viewed 2804 times since Tue, Apr 18, 2017
Nagios XI - Ajaxterm Installation Aborted
Viewed 2249 times since Tue, Jan 26, 2016
Nagios XI - Scheduled Reports Not Running
Viewed 2897 times since Thu, Aug 10, 2017
Nagios XI - SNMPTT Service generates Cannot find module errors
Viewed 3206 times since Sun, Apr 9, 2017
Upgrading EOL Operating Systems on a Nagios System
Viewed 790 times since Thu, Apr 29, 2021
Nagios XI - ERROR: unable to open include file: conf.d/*.cfg
Viewed 3163 times since Sun, May 29, 2016
Nagios XI - mysql_error out of range value for column
Viewed 3393 times since Tue, Aug 14, 2018
Installation errors on customized corporate builds of CentOS or RHEL
Viewed 5647 times since Tue, Jan 26, 2016