{
  "port": 5666,
  "protocol": "tcp",
  "service": "NRPE (Nagios Remote Plugin Executor)",
  "oneLiner": "A monitoring agent — the Nagios server connects here to run checks on this host.",
  "whatItIs": "NRPE runs on a monitored machine and executes local plugins (disk, load, process checks) on request from a Nagios, Icinga, or Naemon server, returning the status text and exit code. IANA registered 5666 to Nagios Enterprises in 2017. Access control is a plaintext allowed_hosts list plus, in NRPE 3 and later, TLS — but the default anonymous-DH mode encrypts without authenticating either side. Enabling dont_blame_nrpe so callers may pass arguments has repeatedly turned into remote command execution.",
  "exposure": {
    "verdict": "never",
    "note": "It exists to run commands on the host for whoever asks — restrict it to the monitoring server's address, keep command arguments disabled, and never publish it."
  },
  "checkCommand": "check_nrpe -H TARGET",
  "links": [
    {
      "title": "NagiosEnterprises/nrpe",
      "url": "https://github.com/NagiosEnterprises/nrpe",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 5666 (nrpe)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5666",
      "kind": "iana"
    }
  ]
}