NRPE That Answers Only A Nagios Server Holding Your Certificate

nrpe

NRPE from EPEL, the agent a Nagios server asks to run checks on this host, answering only a client that presents a certificate your CA signed: TLS 1.2 or later, anonymous Diffie-Hellman off, arguments from the network refused, the listener on loopback until you open it, and every file checked by starting it before it lands. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No download, and no version to pin. EL 10 packages nrpe in EPEL, so the role installs it by name and takes what the distribution ships: a security update arrives through dnf, not through a new release of this role. What the role owns is the configuration and the proof that the service works.

The distribution's unit, our configuration. The role installs nrpe and the load, disk, users and procs plugins from EPEL, writes /etc/nagios/nrpe.cfg (root:nrpe 0640) and enables the package's nrpe.service, which runs as the nrpe user. The listener is 127.0.0.1:5666 by default; set nrpe_listen_address and add your Nagios server to nrpe_allowed_hosts to open it. The live test reads the listening sockets and expects loopback only.

The package's TLS proves nothing about either side. The stock file turns on anonymous Diffie-Hellman: the stock client negotiated ADH-AES256-GCM-SHA384 with "no peer certificate available" (measured). The traffic is encrypted, but neither side is authenticated: anyone who can reach the port and offers an anonymous suite is a client, and anyone in the path can pose as the server. The stock file also listens on every address (0.0.0.0:5666 and [::]:5666). The role turns ADH off and requires a client certificate signed by its CA (ssl_client_certs=2): no certificate, a self-signed one and an ADH-only client are each refused, and the right certificate runs commands over TLS 1.3. Either setting alone already stops ADH - an ADH-only client was refused with client certificates required and ssl_use_adh=1, and with ssl_use_adh=0 and no client certificates (both measured) - and the role sets both, so the refusal does not hang on one line; the live test checks the settings as well as the refusals.

A CA per host unless you bring one. By default the role makes a CA, a server certificate and one client certificate for your Nagios server in /etc/nagios/iacbazaar-tls (keys root 0600; the server key root:nrpe 0640), once. A fleet should not have a CA per host: set nrpe_tls_generate: false and point nrpe_tls_ca, nrpe_tls_cert and nrpe_tls_key at files your own CA issued.

Addresses and arguments. allowed_hosts is checked before the handshake: a client on 127.0.0.2 with the right certificate was dropped ("Host 127.0.0.2 is not allowed to talk to us!"). Arguments stay refused (dont_blame_nrpe=0): a request with -a is logged and dropped, so each command in nrpe_commands runs exactly as written.

The plugins need procps-ng. check_load reads the load from uptime and the process checks run ps, both from procps-ng, which the plugin packages do not require: on a minimal host check_load answered "could not parse load 0 from uptime" (measured). The role installs procps-ng with them.

A checker, because NRPE has none. NRPE stops at once on a line it cannot parse, a value it does not know (ssl_client_certs=7) or a certificate or key its user cannot read, and accepts an unknown option, an address like 999.1.1.1 and a missing include_dir without a word (measured). The role starts each candidate as the nrpe user on a spare port for three seconds, so a key only root can read is refused before it reaches the service. What NRPE accepts silently stays your review's to catch.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.