You are seeing port 113 return requests either from your Nagios XI server (when submitting NSCA passive results) to the originating host OR you are seeing port 113 return requests when checking NRPE services).
You will see this behaviour on your firewall logs as you will most likely not have a firewall rule for port 113.
This is usually because you are running an NRPE check through XINETD with USERID included on the log_on_success or log_on_failure options in your remote hosts /etc/xinetd.d/nrpe file.
OR this could be because you are submitting passive results to the XI server through NSCA (which is running under XINETD) /etc/xinetd.d/nsca with the same options as above.
Further information can be found in the following link:
Note that the USERID option requires an IDENT request to port 113 on the originating server to determine the USERID, that's why you're seeing it.
Then remove the USERID option from the log_on_failure AND log_on_success to stop the IDENT from occurring. The file you need to change depends on:
For example, either comment this line out or remove it completely:
# default: on
# description: NSCA (Nagios Service Check Acceptor)
flags = REUSE
socket_type = stream
wait = no
user = nagios
group = nagios
server = /usr/local/nagios/bin/nsca
server_args = -c /usr/local/nagios/etc/nsca.cfg --inetd
log_on_failure += USERID
disable = no
only_from = 127.0.0.1
After making the changes you need to restart the xinetd service using one of the commands below:
RHEL 6 | CentOS 6 | Oracle Linux 6 | Ubuntu 14
service xinetd restart
RHEL 7 | CentOS 7 | Oracle Linux 7 | Debian | Ubuntu 16/18
systemctl restart xinetd.service
For any support related questions please visit the Nagios Support Forums at:
Article ID: 840
Created On: Tue, Mar 12, 2019 at 6:58 PM
Last Updated On: Wed, Mar 13, 2019 at 8:45 AM
Authored by: tlea
Online URL: https://support.nagios.com/kb/article/disabling-port-113-ident-requests-840.html