I have numerous windows clients that I want to monitor via nagios/nsclient. I've installed the latest nsclient on two win7 x64 and one win2012 r2. Of these one win7 works while the other two machines return could not complete SSL handshake when a connection is attempted from the nagios machine (libexec/check_nrpe -H hostname -c check_cpu).

What I've tried:

  1. check passwords - all these systems have identical nsclient.ini files.
  2. check ports - nmap -P0 client_name returns the same for all (ports 5666 is open)
  3. run nscp test - non-working systems return sslv3 alert: unexpected message(win7) or failed to establish secure connection: no shared cipher (win2012)

I'm stuck trying to figure out what's different between the working and non working windows 7 systems and trying to apply this to a windows 2012 system.

  • What version of check_nrpe? – Keith Feb 2 '15 at 17:47
  • Looks like 2.15. But that part is consistent between the working and nonworking systems. – ethrbunny Feb 2 '15 at 17:49

If you are using 0.4.3 (which I assume) "default" security has been improved a bit. This unfortunately means the rather insecure check_nrpe wont work.

When you install NSClient++ you have the option of selecting "insecure mode" which should work fine with the classic check_nrpe.

You can also tweak this "in post" using the nrpe command like so:

nscp nrpe install --insecure

If you want to use the "slightly more secure" modes offered by NSClient++ you need to install NSClient++ on the nagios server as well and use the NSClient++ version of check_nrpe which support modern SSL and certificate based authentication.

| improve this answer | |
  • I saw this reference in the various forums. I will try it but it doesn't explain (to me) why there would be a difference between my three machines - all installed on the same day, from the same place, and using the same settings. – ethrbunny Feb 3 '15 at 13:21
  • You can always copy the config from one node to the next, then it should be no change. Please also note that restart the service is required for changes to take effect. – Michael Medin Feb 3 '15 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.