Mantis - nrpe
Viewing Issue Advanced Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
3939 regular use tweak have not tried 2009-10-05 14:32 2012-07-12 11:07
Reporter: alexs77 Platform:  
Assigned To: ja OS:  
Priority: normal OS Version:  
Status: closed Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version:  
Summary: 0003939: NRPE installation instructions urge to use inetd for tcp_wrappers
Description: The NRPE installation instructions strongly urge, that tcp_wrappers should be used to protect the installation. For this, it's written that inetd should be used.

Right now, nrpe is launched as a standalone daemon.

So that nrpe can be launched from inetd, the following line should be appended to /etc/services:

nrpe 5666/tcp

And to make inetd start/stop nrpe, add this line to /etc/inetd.conf:

nrpe stream tcp nowait nagios /usr/sfw/sbin/tcpd /opt/csw/bin/nrpe -c /opt/csw/etc/nrpe.cfg -i

On Solaris 10, that line should be written to some temporary file and then

inetconv -i $temp_file_with_inetd_line

is to be invoked.

After that, it might be a good idea to enable TCP_WRAPPER support; on Solaris 10, do:

inetadm -m svc:/network/nrpe/tcp:default tcp_wrappers=TRUE

For Solaris 8 & 9:

         tcp_wrappers is equivalent to the previous inetd's
         /etc/default/inetd property ENABLE_TCPWRAPPERS.

So that inetd is able to start nrpe, the $HOME directory of the user starting nrpe (ie. "nagios") has to exist; IOW: /opt/csw/nagios must exist. On a host which only has nrpe (and maybe nagios-plugins) installed, that's not the case.
Steps To Reproduce:
Additional Information:
Relationships
Attached Files:
Issue History
Date Modified Username Field Change
2009-10-05 14:32 alexs77 New Issue
2009-10-11 22:02 ja Status new => assigned
2009-10-11 22:02 ja Assigned To => ja
2009-10-12 23:01 ja Note Added: 0006850
2009-10-13 08:20 alexs77 Note Added: 0006854
2012-07-12 11:07 ja Note Added: 0010018
2012-07-12 11:07 ja Status assigned => closed
2012-07-12 11:07 ja Resolution open => fixed

Notes
(0006850)
ja   
2009-10-12 23:01   
New packages are available in testing. They don't fix the use of a tcp wrapper. They fix the missing home directory and the config files were moved to /etc/opt/csw/.

The use of a tcp wrapper needs further investigations.
(0006854)
alexs77   
2009-10-13 08:20   
ja,
thanks a lot!

What further investigation? :) If nrpe is started standalone, then tcp_wrapper isn't used. If started using inetd, then tcp_wrapper can be used (depending on the configuration of the inetd, of course).
(0010018)
ja   
2012-07-12 11:07   
Issue closed. In case of further problems reopen it.