You don't want a config file to be owned (much less writeable!) by the daemon it configures.

The `root` account must own this file, and NRPE must be allowed to read it by having group-read permissions. Anything more permissive than 0644 to `root.nrpeuser` is a security issue.