{"action":"closed","issue":{"url":"https://api.github.com/repos/NagiosEnterprises/ncpa/issues/218","repository_url":"https://api.github.com/repos/NagiosEnterprises/ncpa","labels_url":"https://api.github.com/repos/NagiosEnterprises/ncpa/issues/218/labels{/name}","comments_url":"https://api.github.com/repos/NagiosEnterprises/ncpa/issues/218/comments","events_url":"https://api.github.com/repos/NagiosEnterprises/ncpa/issues/218/events","html_url":"https://github.com/NagiosEnterprises/ncpa/issues/218","id":151725433,"number":218,"title":"Feature Request - Add AES Support to NSCA","user":{"login":"ludmilmm","id":1896530,"avatar_url":"https://avatars.githubusercontent.com/u/1896530?v=3","gravatar_id":"","url":"https://api.github.com/users/ludmilmm","html_url":"https://github.com/ludmilmm","followers_url":"https://api.github.com/users/ludmilmm/followers","following_url":"https://api.github.com/users/ludmilmm/following{/other_user}","gists_url":"https://api.github.com/users/ludmilmm/gists{/gist_id}","starred_url":"https://api.github.com/users/ludmilmm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ludmilmm/subscriptions","organizations_url":"https://api.github.com/users/ludmilmm/orgs","repos_url":"https://api.github.com/users/ludmilmm/repos","events_url":"https://api.github.com/users/ludmilmm/events{/privacy}","received_events_url":"https://api.github.com/users/ludmilmm/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-04-28T19:37:42Z","updated_at":"2016-04-28T19:49:45Z","closed_at":"2016-04-28T19:49:45Z","body":"When you use NSCA with NSClient++ only the AES-128 works properly. See the example below:\r\n\r\nIn the **nsclient.ini** on the Windows server:\r\n\r\n`; ENCRYPTION - Name of encryption algorithm to use. Has to be the same as your server i using or it wont work at all.This is also independent of SSL and generally used instead of SSL. Available encryption algorithms are: none = No Encryption (not safe) xor = XOR des = DES 3des = DES-EDE3 cast128 = CAST-128 xtea = XTEA blowfish = Blowfish twofish = Twofish rc2 = RC2 aes128 = AES aes192 = AES aes = AES serpent = Serpent gost = GOST\r\n\r\nencryption = AES`\r\n\r\nIn the **nsca.cfg** on the Nagios XI box:\r\n\r\n`\\#       0 = None        (Do NOT use this option)\r\n\\#       1 = Simple XOR  (No security, just obfuscation, but very fast)\r\n\\#\r\n\\#       2 = DES\r\n\\#       3 = 3DES (Triple DES)\r\n\\#       4 = CAST-128\r\n\\#       5 = CAST-256\r\n\\#       6 = xTEA\r\n\\#       7 = 3WAY\r\n\\#       8 = BLOWFISH\r\n\\#       9 = TWOFISH\r\n\\#       10 = LOKI97\r\n\\#       11 = RC2\r\n\\#       12 = ARCFOUR\r\n\\#\r\n\\#       14 = RIJNDAEL-128\r\n\\#       15 = RIJNDAEL-192\r\n\\#       16 = RIJNDAEL-256\r\n\\#\r\n\\#       19 = WAKE\r\n\\#       20 = SERPENT\r\n\\#\r\n\\#       22 = ENIGMA (Unix crypt)\r\n\\#       23 = GOST\r\n\\#       24 = SAFER64\r\n\\#       25 = SAFER128\r\n\\#       26 = SAFER+\r\n\\#\r\n\r\ndecryption_method=14`\r\n\r\nThe above scenario works. If however, you use option 15 or 16 (RIJNDAEL-192 or RIJNDAEL-256), the passive check results are not being received, and you can see errors in the \"/var/log/messages\" similar to this one:\r\n`Apr 28 10:10:09 localhost nsca[10945]: Received invalid packet type/version from client - possibly due to client using wrong password or crypto algorithm?`\r\n\r\nAccording to a Nagios XI user on the Nagios Support forum, the issue is in fact this:\r\n\r\n> AES has a fixed block size of 128 bits and a key size of 128, 192, or 256 bits, whereas Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits and a maximum of 256 bits.\r\n\r\nAES-192 and AES-256 support needs to be added to NSCA so that it can be used with NSClient++."}}