NSClientServer¶

Available on Windows only.

A server that listens for incoming check_nt connection and processes incoming requests.

NSClientServer implements the original NSClient protocol (TCP 12489 by default) spoken by the Nagios check_nt plugin. It answers the classic check_nt variables (CLIENTVERSION, CPULOAD, UPTIME, USEDDISKSPACE, SERVICESTATE, PROCSTATE, MEMUSE, COUNTER, FILEAGE, INSTANCES) by mapping them onto the modern checks (check_cpu, check_uptime, check_drivesize, …), so the corresponding modules (CheckSystem, CheckDisk) must also be loaded for those variables to work.

check_nt is a legacy protocol - avoid it for new setups

The protocol predates modern transport security: the password travels in cleartext in every request and virtually no check_nt client can speak TLS. Prefer NRPE or the REST API and leave this module disabled unless you must support an existing check_nt deployment. See the securing guide for the full risk discussion and migration advice.

To use this module you need to enable it:

[/modules]
NSClientServer = enabled

Securing the server¶

Three settings make up the security configuration; all live under [/settings/NSClient/server] (allowed hosts and password can also be inherited from [/settings/default]):

password - required. A server without a password refuses every request, so this must be set for the module to answer at all. The client sends it with check_nt -s <password>. Since the protocol transmits it in cleartext on every request, use a password dedicated to check_nt and used nowhere else. A wrong or missing password is answered with a generic ERROR: Bad request. so the reply does not reveal whether the password or the request was the problem.
allowed hosts - restrict which addresses may connect at all. This is the strongest control the protocol offers; limit it to your monitoring server(s), e.g. allowed hosts = 127.0.0.1,192.168.0.10.
use ssl - defaults to true, but the standard nagios-plugins check_nt cannot speak TLS, so interoperating with it requires explicitly setting use ssl = false. Doing so is your consent to running the protocol in cleartext - treat the network path as untrusted and rely on allowed hosts (and network segmentation) instead.

Restricting commands with `allow`¶

By default the server answers every check_nt variable (allow = any). The allow setting caps that: it is a comma separated list where each entry is a group, the keyword any/all, or an individual command name. Anything not enabled is refused before dispatch with ERROR: Command not allowed.

Token	Enables	Note
`any` / `all`	everything	full check_nt compatibility (default)
`metrics`	`cpuload`, `uptime`, `useddiskspace`, `memuse`	harmless aggregate system metrics
`info`	`clientversion`
`service`	`servicestate`	service enumeration
`process`	`procstate`	process enumeration
`counters`	`counter`, `instances`	arbitrary performance-counter reads
`files`	`fileage`	arbitrary file existence/age probing
individual command	just that command	e.g. `uptime`, `counter`, `servicestate`, …

Unknown tokens are logged and enable nothing, and an allow list that resolves to no commands makes the server refuse every request (fail closed) - so a typo narrows access rather than widening it.

A locked-down configuration that only exposes aggregate system metrics and the agent version - denying the arbitrary-read commands (counter, fileage, instances) and the service/process enumeration - looks like this:

[/settings/NSClient/server]
allow = metrics, info
allowed hosts = 192.168.0.10
password = a-password-used-only-for-check_nt
use ssl = false

Enable module¶

To enable this module and and allow using the commands you need to ass NSClientServer = enabled to the [/modules] section in nsclient.ini:

[/modules]
NSClientServer = enabled

Configuration¶

Path / Section	Description
/settings/NSClient/server	NSCLIENT SERVER SECTION
/settings/default	Default values

NSCLIENT SERVER SECTION ¶

Section for NSClient (NSClientServer.dll) (check_nt) protocol options.

Key	Default Value	Description
allow	any	ALLOWED COMMANDS
allowed ciphers	ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH	ALLOWED CIPHERS
allowed hosts	127.0.0.1	Allowed hosts
bind to		BIND TO ADDRESS
ca	${certificate-path}/ca.pem	CA
cache allowed hosts	true	Cache list of allowed hosts
certificate	${certificate-path}/certificate.pem	SSL CERTIFICATE
certificate format	PEM	CERTIFICATE FORMAT
certificate key		SSL CERTIFICATE
debug verify	false	Debug peer certificate verification
dh		DH KEY
password		Password
performance data	true	PERFORMANCE DATA
port	12489	PORT NUMBER
socket queue size	0	LISTEN QUEUE
ssl options		VERIFY MODE
thread pool	10	THREAD POOL
timeout	30	TIMEOUT
tls version	tlsv1.2+	TLS version to use
use ssl	true	ENABLE SSL ENCRYPTION
verify mode	none	VERIFY MODE

# Section for NSClient (NSClientServer.dll) (check_nt) protocol options.
[/settings/NSClient/server]
allow=any
allowed ciphers=ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH
allowed hosts=127.0.0.1
ca=${certificate-path}/ca.pem
cache allowed hosts=true
certificate=${certificate-path}/certificate.pem
certificate format=PEM
debug verify=false
performance data=true
port=12489
socket queue size=0
thread pool=10
timeout=30
tls version=tlsv1.2+
use ssl=true
verify mode=none

ALLOWED COMMANDS ¶

Comma separated list of which check_nt commands this server will answer. Each entry is a group, the keyword ‘any’/’all’, or an individual command name. Groups: ‘metrics’ (cpuload, uptime, useddiskspace, memuse), ‘info’ (clientversion), ‘service’ (servicestate), ‘process’ (procstate), ‘counters’ (counter, instances), ‘files’ (fileage). Individual commands: clientversion, cpuload, uptime, useddiskspace, servicestate, procstate, memuse, counter, fileage, instances. Default ‘any’ answers everything (full check_nt compatibility). To expose only harmless system metrics use e.g. ‘metrics, info’; this denies the arbitrary-read commands (counter, fileage, instances) and the service/process enumeration commands.

Key	Description
Path:	/settings/NSClient/server
Key:	allow
Default value:	`any`

Sample:

[/settings/NSClient/server]
# ALLOWED COMMANDS
allow=any

ALLOWED CIPHERS ¶

The chipers which are allowed to be used. The default here will differ is used in “insecure” mode or not. check_nrpe uses a very old chipers and should preferably not be used. For details of chipers please see the OPEN ssl documentation: https://www.openssl.org/docs/apps/ciphers.html

Key	Description
Path:	/settings/NSClient/server
Key:	allowed ciphers
Advanced:	Yes (means it is not commonly used)
Default value:	`ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH`

Sample:

[/settings/NSClient/server]
# ALLOWED CIPHERS
allowed ciphers=ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH

Allowed hosts ¶

A comma separated list of allowed hosts. You can use netmasks (/ syntax) or * to create ranges.

Key	Description
Path:	/settings/NSClient/server
Key:	allowed hosts
Default value:	`127.0.0.1`

Sample:

[/settings/NSClient/server]
# Allowed hosts
allowed hosts=127.0.0.1

BIND TO ADDRESS ¶

Allows you to bind server to a specific local address. This has to be a dotted ip address not a host name. Leaving this blank will bind to all available IP addresses.

Key	Description
Path:	/settings/NSClient/server
Key:	bind to
Default value:	N/A

Sample:

[/settings/NSClient/server]
# BIND TO ADDRESS
bind to=

CA ¶

Key	Description
Path:	/settings/NSClient/server
Key:	ca
Advanced:	Yes (means it is not commonly used)
Default value:	`${certificate-path}/ca.pem`

Sample:

[/settings/NSClient/server]
# CA
ca=${certificate-path}/ca.pem

Cache list of allowed hosts ¶

If host names (DNS entries) should be cached, improves speed and security somewhat but won’t allow you to have dynamic IPs for your Nagios server.

Key	Description
Path:	/settings/NSClient/server
Key:	cache allowed hosts
Default value:	`true`

Sample:

[/settings/NSClient/server]
# Cache list of allowed hosts
cache allowed hosts=true

SSL CERTIFICATE ¶

Key	Description
Path:	/settings/NSClient/server
Key:	certificate
Advanced:	Yes (means it is not commonly used)
Default value:	`${certificate-path}/certificate.pem`

Sample:

[/settings/NSClient/server]
# SSL CERTIFICATE
certificate=${certificate-path}/certificate.pem

CERTIFICATE FORMAT ¶

Key	Description
Path:	/settings/NSClient/server
Key:	certificate format
Advanced:	Yes (means it is not commonly used)
Default value:	`PEM`

Sample:

[/settings/NSClient/server]
# CERTIFICATE FORMAT
certificate format=PEM

SSL CERTIFICATE ¶

Key	Description
Path:	/settings/NSClient/server
Key:	certificate key
Advanced:	Yes (means it is not commonly used)
Default value:	N/A

Sample:

[/settings/NSClient/server]
# SSL CERTIFICATE
certificate key=

Debug peer certificate verification ¶

Set this to tru to output certificate verification errors, these are outputed to stdout (not the log).

Key	Description
Path:	/settings/NSClient/server
Key:	debug verify
Advanced:	Yes (means it is not commonly used)
Default value:	`false`

Sample:

[/settings/NSClient/server]
# Debug peer certificate verification
debug verify=false

DH KEY ¶

Key	Description
Path:	/settings/NSClient/server
Key:	dh
Advanced:	Yes (means it is not commonly used)
Default value:	N/A

Sample:

[/settings/NSClient/server]
# DH KEY
dh=

Password ¶

Password used to authenticate against server

Key	Description
Path:	/settings/NSClient/server
Key:	password
Default value:	N/A

Sample:

[/settings/NSClient/server]
# Password
password=

PERFORMANCE DATA ¶

Send performance data back to Nagios (set this to 0 to remove all performance data).

Key	Description
Path:	/settings/NSClient/server
Key:	performance data
Default value:	`true`

Sample:

[/settings/NSClient/server]
# PERFORMANCE DATA
performance data=true

PORT NUMBER ¶

Port to use for check_nt.

Key	Description
Path:	/settings/NSClient/server
Key:	port
Default value:	`12489`

Sample:

[/settings/NSClient/server]
# PORT NUMBER
port=12489

LISTEN QUEUE ¶

Number of sockets to queue before starting to refuse new incoming connections. This can be used to tweak the amount of simultaneous sockets that the server accepts.

Key	Description
Path:	/settings/NSClient/server
Key:	socket queue size
Advanced:	Yes (means it is not commonly used)
Default value:	`0`

Sample:

[/settings/NSClient/server]
# LISTEN QUEUE
socket queue size=0

VERIFY MODE ¶

Comma separated list of verification flags to set on the SSL socket.

default-workarounds Various workarounds for what I understand to be broken ssl implementations no-sslv2 Do not use the SSLv2 protocol (prefer tls version instead). no-sslv3 Do not use the SSLv3 protocol (prefer tls version instead). no-tlsv1 Do not use the TLSv1 protocol (prefer tls version instead). no-tlsv1_1 Do not use the TLSv1.1 protocol (prefer tls version instead). no-tlsv1_2 Do not use the TLSv1.2 protocol (prefer tls version instead). no-tlsv1_3 Do not use the TLSv1.3 protocol (prefer tls version instead). single-dh-use Always create a new key when using temporary/ephemeral DH parameters. This option must be used to prevent small subgroup attacks, when the DH parameters were not generated using “strong” primes (e.g. when using DSA-parameters).

Key	Description
Path:	/settings/NSClient/server
Key:	ssl options
Advanced:	Yes (means it is not commonly used)
Default value:	N/A

Sample:

[/settings/NSClient/server]
# VERIFY MODE
ssl options=

THREAD POOL ¶

Key	Description
Path:	/settings/NSClient/server
Key:	thread pool
Advanced:	Yes (means it is not commonly used)
Default value:	`10`

Sample:

[/settings/NSClient/server]
# THREAD POOL
thread pool=10

TIMEOUT ¶

Timeout (in seconds) when reading packets on incoming sockets. If the data has not arrived within this time we will bail out.

Key	Description
Path:	/settings/NSClient/server
Key:	timeout
Default value:	`30`

Sample:

[/settings/NSClient/server]
# TIMEOUT
timeout=30

TLS version to use ¶

Valid options are tlsv1.3, tlsv1.2, tlsv1.1, tlsv1.0, sslv3 as well as tlsv1.3+, tlsv1.2+, tlsv1.1+, tlsv1.0+, sslv3+ (Which uses the version mentioned and above)

Key	Description
Path:	/settings/NSClient/server
Key:	tls version
Advanced:	Yes (means it is not commonly used)
Default value:	`tlsv1.2+`

Sample:

[/settings/NSClient/server]
# TLS version to use
tls version=tlsv1.2+

ENABLE SSL ENCRYPTION ¶

This option controls if SSL should be enabled.

Key	Description
Path:	/settings/NSClient/server
Key:	use ssl
Default value:	`true`

Sample:

[/settings/NSClient/server]
# ENABLE SSL ENCRYPTION
use ssl=true

VERIFY MODE ¶

Comma separated list of verification flags to set on the SSL socket.

none The server will not send a client certificate request to the client, so the client will not send a certificate. peer The server sends a client certificate request to the client and the certificate returned (if any) is checked. fail-if-no-cert if the client did not return a certificate, the TLS/SSL handshake is immediately terminated. This flag must be used together with peer. peer-cert Alias for peer and fail-if-no-cert. workarounds Various bug workarounds. single Always create a new key when using tmp_dh parameters. client-once Only request a client certificate on the initial TLS/SSL handshake. This flag must be used together with verify-peer

Key	Description
Path:	/settings/NSClient/server
Key:	verify mode
Advanced:	Yes (means it is not commonly used)
Default value:	`none`

Sample:

[/settings/NSClient/server]
# VERIFY MODE
verify mode=none

Default values ¶

Default values used in other config sections.

Key	Default Value	Description
allowed hosts	127.0.0.1	Allowed hosts
bind to		BIND TO ADDRESS
cache allowed hosts	true	Cache list of allowed hosts
encoding		NRPE PAYLOAD ENCODING
inbox	inbox	INBOX
password		Password
socket queue size	0	LISTEN QUEUE
thread pool	10	THREAD POOL
timeout	30	TIMEOUT
timezone	local	Timezone

# Default values used in other config sections.
[/settings/default]
allowed hosts=127.0.0.1
cache allowed hosts=true
inbox=inbox
socket queue size=0
thread pool=10
timeout=30
timezone=local

Allowed hosts ¶

A comma separated list of allowed hosts. You can use netmasks (/ syntax) or * to create ranges.

Key	Description
Path:	/settings/default
Key:	allowed hosts
Default value:	`127.0.0.1`

Sample:

[/settings/default]
# Allowed hosts
allowed hosts=127.0.0.1

BIND TO ADDRESS ¶

Allows you to bind server to a specific local address. This has to be a dotted ip address not a host name. Leaving this blank will bind to all available IP addresses.

Key	Description
Path:	/settings/default
Key:	bind to
Default value:	N/A

Sample:

[/settings/default]
# BIND TO ADDRESS
bind to=

Cache list of allowed hosts ¶

If host names (DNS entries) should be cached, improves speed and security somewhat but won’t allow you to have dynamic IPs for your Nagios server.

Key	Description
Path:	/settings/default
Key:	cache allowed hosts
Default value:	`true`

Sample:

[/settings/default]
# Cache list of allowed hosts
cache allowed hosts=true

NRPE PAYLOAD ENCODING ¶

Key	Description
Path:	/settings/default
Key:	encoding
Advanced:	Yes (means it is not commonly used)
Default value:	N/A

Sample:

[/settings/default]
# NRPE PAYLOAD ENCODING
encoding=

INBOX ¶

The default channel to post incoming messages on

Key	Description
Path:	/settings/default
Key:	inbox
Default value:	`inbox`

Sample:

[/settings/default]
# INBOX
inbox=inbox

Password ¶

Password used to authenticate against server

Key	Description
Path:	/settings/default
Key:	password
Default value:	N/A

Sample:

[/settings/default]
# Password
password=

LISTEN QUEUE ¶

Number of sockets to queue before starting to refuse new incoming connections. This can be used to tweak the amount of simultaneous sockets that the server accepts.

Key	Description
Path:	/settings/default
Key:	socket queue size
Advanced:	Yes (means it is not commonly used)
Default value:	`0`

Sample:

[/settings/default]
# LISTEN QUEUE
socket queue size=0

THREAD POOL ¶

Key	Description
Path:	/settings/default
Key:	thread pool
Advanced:	Yes (means it is not commonly used)
Default value:	`10`

Sample:

[/settings/default]
# THREAD POOL
thread pool=10

TIMEOUT ¶

Timeout (in seconds) when reading packets on incoming sockets. If the data has not arrived within this time we will bail out.

Key	Description
Path:	/settings/default
Key:	timeout
Default value:	`30`

Sample:

[/settings/default]
# TIMEOUT
timeout=30

Timezone ¶

Timezone used to render dates such as boot time. Accepts ‘local’ (default), ‘utc’, or any POSIX TZ string parseable by Boost.Date_time (e.g. ‘MST-07’ or ‘EST-05EDT,M3.2.0,M11.1.0’).

Key	Description
Path:	/settings/default
Key:	timezone
Advanced:	Yes (means it is not commonly used)
Default value:	`local`

Sample:

[/settings/default]
# Timezone
timezone=local

NSClientServer¶

Securing the server¶

Restricting commands with allow¶

Enable module¶

Configuration¶

NSCLIENT SERVER SECTION ¶

ALLOWED COMMANDS ¶

ALLOWED CIPHERS ¶

Allowed hosts ¶

BIND TO ADDRESS ¶

CA ¶

Cache list of allowed hosts ¶

SSL CERTIFICATE ¶

CERTIFICATE FORMAT ¶

SSL CERTIFICATE ¶

Debug peer certificate verification ¶

DH KEY ¶

Password ¶

PERFORMANCE DATA ¶

PORT NUMBER ¶

LISTEN QUEUE ¶

VERIFY MODE ¶

THREAD POOL ¶

TIMEOUT ¶

TLS version to use ¶

ENABLE SSL ENCRYPTION ¶

VERIFY MODE ¶

Default values ¶

Allowed hosts ¶

BIND TO ADDRESS ¶

Cache list of allowed hosts ¶

NRPE PAYLOAD ENCODING ¶

INBOX ¶

Password ¶

LISTEN QUEUE ¶

THREAD POOL ¶

TIMEOUT ¶

Timezone ¶

Restricting commands with `allow`¶