Port 5666NRPE
Port 5666 (TCP) is NRPE, the Nagios Remote Plugin Executor: an agent on a Linux or Unix host that runs check plugins when the Nagios server asks and sends back the result. If a check fails with "Could not complete SSL handshake", the Nagios server's address is usually missing from allowed_hosts in nrpe.cfg. Port 5666 should be reachable from the Nagios server and nothing else.
- transport
- tcp
- in transit
- cleartext
- assignment
- unofficial
- risk
- 4/10
- lookups
- 13,605
single transport
payload readable on path
used by convention
caution
rank 264 of 6,669 · top 4%
Technical Details
what runs on :5666NRPE (Nagios Remote Plugin Executor) is an agent that allows a remote Nagios server to communicate with and execute scripts or plugins on remote Linux or Unix machines. It extends Nagios’ monitoring capabilities by enabling remote execution of service checks, especially useful for gathering data that is only available on the target host and not directly accessible via network protocols.
NRPE uses a simple request-response model where the Nagios server connects to the NRPE daemon running on the client. The server sends a command or plugin name, which the client executes locally. The output from the execution is then transmitted back to the Nagios server. This approach enables centralized health and performance monitoring with minimal exposure of remote systems' internal metrics.
Typically, NRPE communicates over TCP port 5666 and relies on its own simple protocol rather than relying on SSL/TLS by default, although encryption can be enabled. It supports access control based on IP restrictions configured on the agent, complementing monitoring workflows across complex infrastructures.
Common errors
- CHECK_NRPE: Error - Could not complete SSL handshake: usually the Nagios server's IP isn't in
allowed_hostsin nrpe.cfg. When NRPE runs under xinetd, nrpe.cfg'sallowed_hostsandserver_portare ignored; setonly_fromin the xinetd service file instead. - Connection refused by host: nothing is listening on 5666, because the daemon isn't running, or a firewall is rejecting the connection.
- NRPE: Unable to read output: the plugin printed nothing to standard output, or the nagios user can't run it. Run the command by hand as that user to see why.
Related ports
NCPA, Nagios's newer cross-platform agent, listens on TCP 5693.
Security Information
exposure of :5666risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
network services averages 2.6 across 2,027 ports — this one sits 1.4 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
unofficial
used by convention, not registered — what answers here varies by deployment
reachable over
tcp
every listening transport is another surface to filter at the edge
security overview
Common Vulnerabilities:
- Lack of default encryption can expose sensitive monitoring data and plugin outputs to eavesdropping and man-in-the-middle attacks.
- Misconfigured allowed_hosts or weak access control can lead to unauthorized command execution remotely.
- Older or unmaintained NRPE versions may contain exploitable security bugs, such as buffer overflows or command injection vulnerabilities.
Common Mitigations:
- Restrict allowed_hosts strictly to Nagios servers’ IP addresses to limit who can execute remote checks.
- Use NRPE with SSL support to encrypt communication channels.
- Regularly update NRPE and underlying libraries to patch vulnerabilities.
- Limit the plugins and commands that can be executed remotely by configuring command definitions carefully.
- Employ network-level protections such as firewalls and segmentation to restrict access to port 5666.
Configuration notes
- Command arguments:
dont_blame_nrpe=1lets the server pass arguments to commands. Upstream calls it a security risk; leave it off unless a check needs it. - Encryption without certificates: without configured certificates, NRPE falls back to anonymous Diffie-Hellman, which encrypts traffic but authenticates neither end. Configure certificates (NRPE 3 and later) if traffic crosses a network you don't trust.
Related Ports
the 8 most looked-up other ports in network services — 2,027 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :9080 | Groove RPC | TCPUDP | Web Services | caution | 70.8k |
| :6543 | Jetnet | UDP | Network Services | caution | 65.3k |
| :5938 | TeamViewer | TCPUDP | Remote Access | caution | 65.0k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3233 | WhiskerControl Protocol | TCPUDP | Network Services | caution | 61.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Tatsoft Default HTTP Proxy | TCP | Web Services | caution | 46.8k |
risk mix of the 8 listed
- caution100%
0 of 8 encrypted