Comments (6)
We can handle the NRPE side, but NSClient++ is a third-party project that we have no control over.
In regards to NRPE, this has been addressed in at least the following PRs:
and possibly elsewhere. @jfrickson and I are discussing this internally and will be taking action likely some time after the conference.
from nrpe.
Thank you,
please let me know if you want me to do some testing-work.
from nrpe.
Posted the Nsclient++ Part of the question to
https://forums.nsclient.org/t/nrpe-and-insecure-ssl-chiphers-dh512-bit-cause-failed-connection-on-ubuntu-linux-14/3859
from nrpe.
Just a heads-up, @jfrickson sent me some literature to review regarding SSL and NRPE, so we're definitely still working on this!
from nrpe.
Hi,
To be able to use ciphers more configureable I have added the new argument "-C" for ./check_nrpe.
/usr/lib/nagios/plugins/check_nrpe -H 10.10.0.155 -p 5666 -C DHE-RSA-AES256-GCM-SHA384
I (0.4.3.143 2015-04-29) seem to be doing fine...
This are the changes i have done.
sudo diff -u check_nrpe_original.c check_nrpe_fertig.c
--- check_nrpe_original.c 2015-11-06 13:10:04.148081438 +0100
+++ check_nrpe_fertig.c 2015-11-09 08:13:29.646154700 +0100
@@ -27,6 +27,7 @@
u_short server_port=DEFAULT_SERVER_PORT;
char *server_name=NULL;
char *bind_address=NULL;
+char *cipher_list="DHE-RSA-AES256-GCM-SHA384";
struct sockaddr_storage hostaddr;
int address_family=AF_UNSPEC;
char *command_name=NULL;
@@ -91,7 +92,7 @@
if(result!=OK || show_help==TRUE){
- printf("Usage: check_nrpe -H <host> [ -b <bindaddr> ] [-4] [-6] [-n] [-u] [-p <port>] [-t <timeout>] [-c <command>] [-a <arglist...>]\n");
+ printf("Usage: check_nrpe -H <host> [ -b <bindaddr> ] [-4] [-6] [-n] [-u] [-p <port>] [-t <timeout>] [-c <command>] [-a <arglist...>] [-C <Chipher_List>]\n");
printf("\n");
printf("Options:\n");
printf(" -n = Do no use SSL\n");
@@ -100,6 +101,7 @@
printf(" <bindaddr> = bind to local address\n");
printf(" -4 = user ipv4 only\n");
printf(" -6 = user ipv6 only\n");
+ printf(" -C = Cipher List\n");
printf(" [port] = The port on which the daemon is running (default=%d)\n",DEFAULT_SERVER_PORT);
printf(" [timeout] = Number of seconds before connection times out (default=%d)\n",DEFAULT_SOCKET_TIMEOUT);
printf(" [command] = The name of the command that the remote daemon should run\n");
@@ -165,22 +167,24 @@
/* do SSL handshake */
if(result==STATE_OK && use_ssl==TRUE){
if((ssl=SSL_new(ctx))!=NULL){
- SSL_CTX_set_cipher_list(ctx,"ADH");
- SSL_set_fd(ssl,sd);
- if((rc=SSL_connect(ssl))!=1){
- printf("CHECK_NRPE: Error - Could not complete SSL handshake.\n");
-#ifdef DEBUG
- printf("SSL_connect=%d\n",rc);
- /*
- rc=SSL_get_error(ssl,rc);
- printf("SSL_get_error=%d\n",rc);
- printf("ERR_get_error=%lu\n",ERR_get_error());
- printf("%s\n",ERR_error_string(rc,NULL));
- */
+ if (SSL_CTX_set_cipher_list(ctx,cipher_list) == 1) {
+ SSL_set_fd(ssl,sd);
+ if((rc=SSL_connect(ssl))!=1){
+ printf("CHECK_NRPE: Error - Could not complete SSL handshake.\n");
+ printf("SSL_connect=%d\n",rc);
+ rc=SSL_get_error(ssl,rc);
+ printf("SSL_get_error=%d\n",rc);
+ printf("ERR_get_error=%lu\n",ERR_get_error());
+ printf("%s\n",ERR_error_string(rc,NULL));
+ ERR_print_errors_fp(stdout);
+ result=STATE_CRITICAL;
+ }
+ }
+ else {
ERR_print_errors_fp(stdout);
-#endif
- result=STATE_CRITICAL;
- }
+ printf("SSL_CTX_set_cipher_list failed with cipher list <%s> \n",cipher_list);
+ result=STATE_CRITICAL;
+ }
}
else{
printf("CHECK_NRPE: Error - Could not create SSL connection structure.\n");
@@ -347,6 +351,7 @@
{"port", required_argument, 0, 'p'},
{"help", no_argument, 0, 'h'},
{"license", no_argument, 0, 'l'},
+ {"cipher", no_argument, 0, 'C'},
{0, 0, 0, 0}
};
#endif
@@ -355,7 +360,7 @@
if(argc<2)
return ERROR;
- snprintf(optchars,MAX_INPUT_BUFFER,"H:b:c:a:t:p:nu46hl");
+ snprintf(optchars,MAX_INPUT_BUFFER,"H:b:c:a:t:p:C:nu46hl");
while(1){
#ifdef HAVE_GETOPT_LONG
@@ -395,6 +400,9 @@
case 'H':
server_name=strdup(optarg);
break;
+ case 'C':
+ cipher_list=strdup(optarg);
+ break;
case 'c':
command_name=strdup(optarg);
break;
@@ -488,4 +496,3 @@
return OK;
}
-
Best Regards,
Alonso
from nrpe.
I have a complete and backward-compatible update for SSL/TLS in https://github.com/NagiosEnterprises/nrpe/tree/nrpe-2-16-RC2
Please read the README.SSL.md file.
from nrpe.
Related Issues (20)
- Unable to build against OpenSSL 3.0.0 HOT 5
- 4.0.3 does not accept v3 Packets HOT 2
- NRPE not showing real output of check_apt HOT 6
- Remove deprecated anonymous diffie-helman options
- Nrpe not working with external ip
- Receive header underflow - only 0 bytes received (4 expected). HOT 1
- Error while making with OpenSSL 1.1.1k
- CHECK_NRPE: Received 0 bytes from daemon. Check the remote server logs for error messages.
- DNS issue should return UNKNOWN or CRITICAL HOT 6
- Parasitic characters in output
- Wrong user owning the nrpe process under AIX HOT 2
- nrpe[xxxx]: ERROR: my_system() write(fd, buffer)-2 failed... HOT 2
- RHEL9 fails with ERR_get_error_line_data HOT 2
- nrpe 4.1: configuration line length issue? HOT 2
- Problema a la hora de compilar el agente npre4.1.0 fedora17
- NRPE v4.1 repo EPEL : nrpe_user and nrpe_group in nrpe.fg not used HOT 2
- NRPE : "deprecated" removed HOT 2
- Feature Request - Support wildcards in exclude arguments HOT 9
- check_nrpe: Could not connect / Receive header underflow HOT 1
- Error: Request contained command arguments! HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nrpe.