<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">
<TITLE></TITLE>
<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.0 (Win32)">
<META NAME="CREATED" CONTENT="20040113;18041660">
<META NAME="CHANGED" CONTENT="20040114;15125390">
</HEAD>
<BODY LANG="en-US" DIR="LTR">
<H1>Nrpe, Blowfish encryption</H1>
<P><A HREF="sas@pipex.net">Stephen Strudwick</A>, Pipex
Communications,<SDFIELD TYPE=DATETIME SDVAL="37999.8059524306" SDNUM="2057;1033;MM/DD/YY">01/13/04</SDFIELD></P>
<H2>Overview</H2>
<P>Addition of Blowfish encryption to nrpe to provide an optional
alternative layer of security because the SSL encryption does not
have any authentication; it only stops people snooping on the data.</P>
<P>Blowfish encryption has been added to the latest <A HREF="http://cvs.sourceforge.net/viewcvs.py/nagios/">nrpe
cvs tree</A> as a compile time option.</P>
<P>Authentication will be provided via a shared key, unique to each
host.</P>
<P>While the IP access control and SSL is good enough for most
people, I felt I needed to add the blowfish code because we will be
installing nrpe on many hundreds of servers, some of which will be
important customer dedicated servers, on public facing lans.</P>
<P>By adding an authentication/encryption scheme to the security it
is one more step an attacker has to take to exploit the server.</P>
<P>We have to demonstrate to our customers we have taken every
reasonable step to protect their servers. IP access control on its
own I believe is exploitable, especially if a server on the same lan
is exploited and the nrpe port is attacked from that server. We have
seen similar such attacks in the past.</P>
<P>While this is very unlikley, and even more unlikley they could
exploit the daemon with command line arguments disabled it is still a
potential risk.</P>
<H2>Usage</H2>
<H3>The patch</H3>
<P>To apply the patch to the cvs tree do:</P>
<P STYLE="margin-left: 2cm">cvs -z3
-d:pserver:anonymous@cvs.sourceforge.net:/cvsroot/nagios co
nrpe<BR>patch -p0 < blowfish_patch</P>
<H3>Installing</H3>
<P>When doing configure do:</P>
<P STYLE="margin-left: 2cm">./configure –enable-blowfish</P>
<P>Add the following line to the nrpe.cfg:</P>
<P STYLE="margin-left: 2cm">blowfish_secret=<secret></P>
<P>And when calling check_nrpe do it like this:</P>
<P STYLE="margin-left: 2cm">./check_nrpe -H <host>-c <command>
-s <secret></P>
<H2>Code changes</H2>
<H3>Changed Files</H3>
<H4>./configure.in</H4>
<P>Added option –enable-blowfish, if selected it disables
<I>check_for_ssl</I>. Also defines <I>HAVE_BF</I>.</P>
<P>Also added a check for floor in the math lib:
<I>AC_CHECK_LIB(m,floor,LDFLAGS="$LDFLAGS -lm")</I></P>
<H4>./include/config.h.in</H4>
<P>Added <I>#undef HAVE_BF</I></P>
<H4>./src/Makefile.in</H4>
<P>Added new files.</P>
<H4>./src/check_nrpe.c</H4>
<P>All changes are within <I>#ifdef HAVE_BF </I>and closely mirror
the SSL additions.</P>
<H4>./src/nrpe.c</H4>
<P>All changes are within <I>#ifdef HAVE_BF </I>and closely mirror
the SSL additions. The exception is the key is initialised within
handle_connection as memory is allocated here and it s therefore
easier to cleanup.</P>
<H3>New files</H3>
<H4>./include/blowfish.h ./src/blowfish.c
</H4>
<P>Original freeware blowfish code by Bruce Schneier.</P>
<H4>./include/bf_crypt.h ./src/bf_crypt.c</H4>
<P>A set of functions to make initialised and encrypting streams of
data easier as the blowfish code will only encrypt 8 bytes at a time.</P>
<P>These functions when encrypting data will pad it out to multiple
of 8.</P>
<H4>./include/bf_utils.h ./src/bf_utils.c</H4>
<P>Functions for socket use, blowfish equivalent of sendall, recvall
etc.</P>
<H2>Testing</H2>
<P>The patch has been tested with these systems running in the
following configurations:</P>
<UL>
<LI><P>From inetd</P>
<LI><P>As daemon</P>
<LI><P>With Blowfish</P>
<LI><P>With SSL</P>
<LI><P>Without encryption</P>
</UL>
<P>On:</P>
<UL>
<LI><P>Linux 2.4.18, I386</P>
<LI><P>Solaris 2.7 sparc (with purify)</P>
</UL>
<P STYLE="margin-bottom: 0cm"><B>Purify Output (nrpe):</B></P>
<P STYLE="margin-bottom: 0cm"><BR>
</P>
<P STYLE="margin-bottom: 0cm">**** Purify instrumented ./nrpe (pid
17853, forked from pid 17850) ****</P>
<PRE>Purify: Searching for all memory leaks...
Memory leaked: 0 bytes (0%); potentially leaked: 0 bytes (0%)
Purify Heap Analysis (combining suppressed and unsuppressed blocks)
Blocks Bytes
Leaked 0 0
Potentially Leaked 0 0
In-Use 97 19146
----------------------------------------
Total Allocated 97 19146
**** Purify instrumented ./nrpe (pid 17853, forked from pid 17850) ****
* Program exited with status code 0.
* 0 access errors, 0 total occurrences.
* 0 bytes leaked.
* 0 bytes potentially leaked.</PRE><P STYLE="margin-bottom: 0cm">
<B>Purify Output (check_nrpe):</B></P>
<P STYLE="margin-bottom: 0cm"><BR>
</P>
<PRE>**** Purify instrumented ./check_nrpe (pid 17694) ****
Purify: Searching for all memory leaks...
Memory leaked: 0 bytes (0%); potentially leaked: 0 bytes (0%)
Purify Heap Analysis (combining suppressed and unsuppressed blocks)
Blocks Bytes
Leaked 0 0
Potentially Leaked 0 0
In-Use 84 2093
----------------------------------------
Total Allocated 84 2093
**** Purify instrumented ./check_nrpe (pid 17694) ****
* Program exited with status code 0.
* 0 access errors, 0 total occurrences.
* 0 bytes leaked.
* 0 bytes potentially leaked.</PRE>
</BODY>
</HTML>