check_ssh executed from Nagios server returns "Server answer: ", nothing else

Question

Commmand works on the host I need to monitor (its IP is denoted as $HOSTADDRESS$ here):

[root@host ~]# /usr/local/nagios/libexec/check_ssh localhost
SSH OK - OpenSSH_4.3 (protocol 2.0)

However, on the Nagios server, it does not:

root@server:~# /usr/lib/nagios/plugins/check_ssh -H $HOSTADDRESS$
Server answer: 

I can see that the port is open:

root@server:~# /usr/lib/nagios/plugins/check_tcp -H $HOSTADDRESS$ -p 22
TCP OK - 0.123 second response time on port 22|time=0.123277s;;;0.000000;10.000000

And I can verify with telnet:

root@server:/etc/nagios3/conf.d# telnet $HOSTADDRESS$ 22
Trying $HOSTADDRESS$...
Connected to $HOSTADDRESS$.
Escape character is '^]'.

After searching the web for two hours and trying different suggestions I am out of ideas. I have several other hosts with similar setup, and they don't have this problem. I have compared the configs and they look the same (I think).

I am clearly missing something here.

Solution

I had the same problem to check an OpenSSH server installed on Windows (KpyM Telnet/SSH Server) and I'm checking the port using check_ssh from my Nagios linux server.

With "check_ssh", I got the answer "Server answer" With "check_tcp" on the port 22 : SSH OK

In the logs of the SSH server on Windows, the ip of the nagios server was in the banned IPs.

I removed the IP in the banned IPs and check_ssh is now ok :

check_ssh answer is now : SSH OK - cryptlib (protocol 2.0)

Maybe it helps. Probably not the same software but maybe the same behaviour.

Comments

[phs]

Thanks for your reply. The SSH itself was setup, but connection attempts were returning "ssh_exchange_identification: Connection closed by remote host". It made me search more, and I found /etc/hosts.deny, and that the Nagios server IP was there. I removed it, but it appeared there again after some time. Investigating this.

[phs]

I think it is Denyhosts script. check_ssh isn't failing after I added Nagios server IP to /etc/hosts.allow. Still kept being added to /etc/hosts.deny though, so I added same IP to /var/lib/denyhosts/allowed-hosts as well. I think it stopped now.

[phs]

Here is the process explained: denyhosts.sourceforge.net/faq.html#3_19

[Keith]

I believe his comment about being able to telnet to 22 was just to show that it wasn't a firewall problem, for the record

[Andrew]

Authentication is not required to read the SSH banner, which is all check_ssh does.