nsclient - debugging connection issues

Question

I have numerous windows clients that I want to monitor via nagios/nsclient. I've installed the latest nsclient on two win7 x64 and one win2012 r2. Of these one win7 works while the other two machines return could not complete SSL handshake when a connection is attempted from the nagios machine (libexec/check_nrpe -H hostname -c check_cpu).

What I've tried:

1. check passwords - all these systems have identical nsclient.ini files.
2. check ports - nmap -P0 client_name returns the same for all (ports 5666 is open)
3. run nscp test - non-working systems return sslv3 alert: unexpected message(win7) or failed to establish secure connection: no shared cipher (win2012)

I'm stuck trying to figure out what's different between the working and non working windows 7 systems and trying to apply this to a windows 2012 system.

Answer 1

If you are using 0.4.3 (which I assume) "default" security has been improved a bit. This unfortunately means the rather insecure check_nrpe wont work.

When you install NSClient++ you have the option of selecting "insecure mode" which should work fine with the classic check_nrpe.

You can also tweak this "in post" using the nrpe command like so:

nscp nrpe install --insecure

If you want to use the "slightly more secure" modes offered by NSClient++ you need to install NSClient++ on the nagios server as well and use the NSClient++ version of check_nrpe which support modern SSL and certificate based authentication.