mickem / nscp

NSClient++
http://nsclient.org
GNU General Public License v2.0
235 stars 91 forks source link

NRPE SSL disabled, but still being used? #713

Open quartersawn opened 3 years ago

quartersawn commented 3 years ago

I'm installing 0.5.2.35 on some new servers, running Windows 2016. Initially I need to get the clients communicating without using SSL. My nsclient.ini looks like this:

[/settings/default]
allowed hosts = 172.16.5.1

[/settings/log]
file name nsclient-debug.log
level = debug
verify mode = none
insecure = true

[/modules]
CheckExternalScripts = disabled
CheckHelpers = disabled
CheckEventLog = disabled
CheckNSCP = disabled
CheckDisk = enabled
CheckSystem = enabled
NSClientServer = enabled
NRPEServer = enabled

[settings/NRPE/server]
use ssl = false
allow arguments = true
allow nasty characters = true
allowed hosts = 172.16.5.1
port = 5666
insecure = true
verify mode = none

To test I run a command line from the Nagios server (Debian) with the "-n" option to disable server side SSL and get an error:

root@monitor:/usr/local/nagios/libexec# ./check_nrpe -H 172.16.7.11 -n -4 -p 5666
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).

In the NSClient++ log I see this:

2021-01-05 08:39:25: debug:c:\source\master\include\nrpe/server/protocol.hpp:92: Accepting connection from: 172.16.5.1, count=1
2021-01-05 08:39:25: error:c:\source\master\include\socket/connection.hpp:273: Seems we other end is not using ssl: unknown protocol
2021-01-05 08:39:25: error:c:\source\master\include\socket/connection.hpp:274: Please review the ssl option as well as ssl options in settings.

It seems that despite disabling SSL, the client is still trying to use it (maybe?). What am I missing here?

Additional info: Older Windows 2008 servers running a legacy client (version 3.x) are fine. (those are being replaced with the newer OS and client) check_nt without SSL works. It's just nrpe that's giving me issues.