problem with nagios client config

[Sunny Jaisinghani]

I changed nrpe.cfg as said. Now it has 3 IP addresses. loopback, server and client

[root@client etc]# grep allowed nrpe.cfg
# that are allowed to talk to the NRPE daemon.
allowed_hosts=127.0.0.1,172.16.128.54,10.18.24.35

I sent a SIGHUP to nrpe PID. Logs from syslog

Nov 17 05:27:27 client nrpe[4885]: Host 172.16.128.54 is not allowed to talk to us!
Nov 17 05:29:33 client nrpe[17221]: Caught SIGHUP - restarting...
Nov 17 05:29:33 client nrpe[17221]: Warning: Daemon is configured to accept command arguments from clients!
Nov 17 05:29:33 client nrpe[17221]: Listening for connections on port 5666
Nov 17 05:29:33 client nrpe[17221]: Allowing connections from: 127.0.0.1,172.16.128.54,10.18.24.35
Nov 17 05:29:56 client nrpe[11456]: Error: Could not complete SSL handshake. 1
Nov 17 05:29:58 client nrpe[11458]: Error: Could not complete SSL handshake. 1

local check fails

[root@client etc]# /usr/local/nagios/libexec/check_nrpe -H 127.0.0.1
Connection refused by host

[Ralph Grothe]

> Nov 17 05:29:33 client nrpe[17221]: Listening for connections on port 5666
> Nov 17 05:29:33 client nrpe[17221]: Allowing connections from: 127.0.0.1,172.16.128.54,10.18.24.35


At least it is now accepting connections from the said IP addresses.

> Nov 17 05:29:33 client nrpe[17221]: Warning: Daemon is configured to accept command arguments from clients!

This warning reminds you that you most likely have configured your nrpe to accept command args which can pose a security risk.
If you don't need to define nrpe commands that use arguments (and this is almost never necessary) then you should better deactivate them and set this directive to 0:

$ grep ^dont_blame /etc/nagios/nrpe.cfg
dont_blame_nrpe=0

> Nov 17 05:29:56 client nrpe[11456]: Error: Could not complete SSL handshake. 1

Now, you only have an SSL issue.

You need to know with what options your nrpe daemon was started.

Either look it up in the process table:

what does a

$ pgrep -fl nrpe

for instance show?

Or look into the init script that starts it.

In mine, which was part of a Dag Wieers nagios-nrpe RPM package the start block looks like this:

prog="nrpe"
desc="Nagios NRPE daemon"

start() {
echo -n $"Starting $desc ($prog): "
daemon $prog -c "$CONFIG" -d
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/$prog
return $RETVAL
}


So there should be a process like:

/usr/sbin/nrpe -c /etc/nagios/nrpe.cfg -d


Btw., have you installed from a prebuilt RPM or compiled NRPE yourself?
If the latter applies, have you compiled in SSL support?

Provided your nrpe binary has compiled-in SSL support and was started as assumed above (i.e. without the "-n" optione) then you must use a check_nrpe client that likewise has built-in SSL support (remember the possible platform difference and thus check_nrpe binaries between remote nrpe host and your nagios server),
and it also must be invoked without the "-n" option or vice versa.

[Sunny Jaisinghani]

Yes Ralph... I had compiled NRPE myself.

i restarted nrpe daemon with -n option and it has resolved my problem.

I had tried all these option before also and i wonder how i missed to see this. Probably i was confused in trying so many options.

[root@server ~]# /usr/local/nagios/libexec/check_nrpe -n -H client
NRPE v2.12

Thanks for helping me clean up the mess in my brain :-)
Appreciate your efforts towards good, meaningful and detailed replies.

Sunny