Nagios. Common Problems When Using NRPE

Following my article Running Remote Commands for Nagios with NRPE, I decided to write down the solution to the most common problem with NRPE: when you run a remote command (in my example, the plugin is on FreeBSD and the agent is on Debian), you get something like this back: CHECK_NRPE: Error receiving data from daemon

This error actually points to several possible problems—five, to be precise.

The Nagios Support FAQ has an excellent topic, Debugging “CHECK_NRPE: Error - Could not complete SSL handshake” errors, which explains the possible problems but does not give specific solutions.

Let’s go through them:

Different versions. Make sure you are using the same version of the check_nrpe plugin and the NRPE daemon. Newer versions of NRPE are usually not backward compatible with older versions.

1

If you have different versions of NRPE installed on your servers, the first thing to do is make them match. Software in the FreeBSD ports collection is usually newer than the packages in Debian, so we’ll install the NRPE agent on Debian manually. Go to the NRPE2 download page and download the NRPE archive (in my case, it was nrpe-2.13):

wget -O nrpe-2.13.tar.gz http://downloads.sourceforge.net/project/nagios/nrpe-2.x/nrpe-2.13/nrpe-2.13.tar.gz
tar -xzf nrpe-2.13.tar.gz
cd nrpe-2.13

# Нам нужна поддержка SSL
sudo apt-get install libssl-dev

# Смотрим где храняться headers от libssl (в моем случае это "/usr/lib/i386-linux-gnu")
dpkg -L libssl-dev | grep libssl.a

# Собираем и устанавливаем
./configure --with-ssl=`which openssl` --with-ssl-lib=/usr/lib/i386-linux-gnu
make
sudo make install

# Останавливаем агента, подменяем бинарник, запускаем агента
sudo /etc/init.d/nagios-nrpe-server stop
sudo cp /usr/local/nagios/bin/nrpe /usr/sbin/nrpe
sudo /etc/init.d/nagios-nrpe-server start

SSL is disabled. Make sure both the NRPE daemon and the check_nrpe plugin were compiled with SSL support and that neither are being run without SSL support (using command line switches).

2

This happens when you install one of the NRPE components without SSL support. On Debian, it is built with SSL by default, so the problem is with the FreeBSD port: you should have selected SSL support during installation. Now let’s reinstall it:

cd /usr/ports/net-mgmt/nrpe2
make config
# Выбираем SSL
[*] SSL   Enable SSL support (disables plain-text server) 
make deinstall clean && make distclean && make install clean

You can find out whether the NRPE agent was built with SSL support by starting it:

$ nrpe2 | head -n8

NRPE - Nagios Remote Plugin Executor
Copyright (c) 1999-2008 Ethan Galstad (nagios@nagios.org)
Version: 2.13
Last Modified: 11-11-2011
License: GPL v2 with exemptions (-l for more info)
TCP Wrappers Available

After reinstalling the port (note the second-to-last line):

$ nrpe2 | head -n8

NRPE - Nagios Remote Plugin Executor
Copyright (c) 1999-2008 Ethan Galstad (nagios@nagios.org)
Version: 2.13
Last Modified: 11-11-2011
License: GPL v2 with exemptions (-l for more info)
>>> SSL/TLS Available: Anonymous DH Mode, OpenSSL 0.9.6 or higher required
TCP Wrappers Available

Incorrect file permissions. Make sure the NRPE config file (nrpe.cfg) is readable by the user (i.e. nagios) that executes the NRPE binary from inetd/xinetd.

3

The nagios user lacks the necessary permissions (since NRPE runs as that user everywhere). Let’s check:

# В Debian
sudo -u nagios /usr/lib/nagios/plugins/check_nrpe
# Во FreeBSD
sudo -u nagios /usr/local/libexec/nagios/check_nrpe2

Also check the permissions on the configuration files.

Pseudo-random device files are not readable. Greg Haygood noted the following… “After wringing my hair out and digging around with truss, I figured out the problem on my Solaris 8 boxen. The files /devices/pseudo/random* (linked through /dev/*random, and provided by Sun patch 112438) were not readable by the nagios user I use to launch NRPE. Making the character devices world-readable solved it.”

4

I haven’t encountered this problem, but there is a setting for it in the configuration file nrpe.cfg (you need to uncomment it):

#allow_weak_random_seed=1

Unallowed address. If you’re running the NRPE daemon under xinetd, make sure that you have a line in the xinetd config file that say “only_from = xxx.xxx.xxx.xxx”, where xxx.xxx.xxx.xxx is the IP address that you’re connected to the NRPE daemon from.

5

Most likely, you forgot to specify allowed_hosts in the configuration file nrpe.cfg, and external hosts simply aren’t authorized to access the NRPE agent. Specify the required IP addresses, separated by commas with no spaces:

allowed_hosts=127.0.0.1,203.0.113.41,203.0.113.42

I haven’t run the agent under xinetd myself; standalone mode suited me fine. But problem number 5 is the most common one on the web, and also the simplest.

What problems did I have?

I only had two problems myself (different NRPE versions and a plugin without SSL support). At first, I got this error:

/usr/local/libexec/nagios/check_nrpe2 -H <REMOTE_SERVER_ADDRESS> -c <COMMAND>
CHECK_NRPE: Error receiving data from daemon

After I updated the NRPE agent version (on Debian) to match the version of the plugin (on FreeBSD) I was running the command from (the solution to problem number 1), the following error appeared in /var/log/syslog (on the Remote Host, Debian):

[nrpe] Error: Could not complete SSL handshake

I fixed it by reinstalling the plugin on FreeBSD, as I described in the solution to problem number 2.

One final tip: if it doesn’t work, start by reading the log at /var/log/syslog or /var/log/messages, because that is where nrpe will write:

tail -f /var/log/syslog
tail -f /var/log/messages

Good luck!