Secure Shell (SSH) in HP SIM

ManualsBrandsHP ManualsSoftwareHP Systems Insight Manager for Linux

Table of Contents

Introduction

................................

.........

Why SSH?

................................

......

What is SSH

................................

....

Other SSH implementations

................................

...............

How

does SSH work?

................................

..........................

The SSH connection process

................................

..............

SSH authentication mechanis

................................

.........

Server authentication

—

Verification of the SSH server system

................................

.....

User Authentication

Verification of the client user’s credentials

................................

...........................

SSH Server on Windows

–

Differences

................................

Cygwin mounts

................................

............................

Passwd and group for Windows Implementa

tions

................................

............

SSH and HP SIM

................................

Which HP SIM features use SSH?

................................

......

SSH Bypass

................................

How does HP SIM use SSH?

................................

..............

Managed system authentication

................................

.........

User authentication

................................

.........................

Renamed or disabled ‘Administrator’ account

................................

................

Configura

tion steps

................................

........................

Configuration Options

................................

................

SSH files

................................

.......

Directory locations of various SSH files

................................

.........................

Known_hosts

................................

..............................

Client Public Key Authentication

................................

...

Host

Based Authentication

................................

...........

Passwd and group files

................................

...............

HP SIM commands and tools

................................

...........

sshuser

................................

......

Mxagentconfig

................................

.......................

Mxnodesecurity

................................

..........................

Install OpenSSH

................................

.........................

Confi

gure or Repair Agents

................................

.........

SSH Keys

................................

Conclusion

................................

....

Common questions and tasks

................................

..............

Secure Shell (SSH) in HP SIM White Paper

Summary of content (40 pages)

PAGE 1
Secure Shell (SSH) in HP SIM White Paper Table of Contents Introduction......................................................................................................................................... 3 Why SSH? ...................................................................................................................................... 3 What is SSH....................................................................................................................................
PAGE 2
Changing the port used by SSH ....................................................................................................... 21 Installing OpenSSH for Windows..................................................................................................... 21 Installation Diagnostic File for SSH ............................................................................................... 22 Coexistence problems with other Cygwin installations....................................................
PAGE 3
Introduction This is an era of the security conscious IT administrator. User names and passwords are no longer passed in the clear over the intranet or Internet. Administrators try to provide secure access into managed systems so that only authorized users have access to our most sensitive information. In the past Telnet was used to log in to a remote system and perform commands that add, delete, and modify files. However, Telnet is not a secure method and does not protect network traffic.
PAGE 4
 scp, which replaces rcp  sftp, which replaces ftp  sshd, which is the server side of the package  Other basic utilities include ssh-add, ssh-agent, ssh-keysign, ssh-keyscan, ssh-keygen, and sftp-server. Other SSH implementations Other implementations of SSH include commercial versions of SSH1 and SSH2 maintained and sold by F-Secure Corporation.
PAGE 5
SSH client SSH server SSH client SSH server SSH authentication mechanisms Every SSH connection involves two authentications in the following order: 1. Server authentication. The SSH client verifies the identity of the SSH server. This authentication ensures the SSH server is genuine and not an imposter. It also guards against an attacker redirecting the network connection to a different machine.
PAGE 6
Host based authentication is very similar to the user public key authentication, and is also based on public and private keys. In this case, separate keys are not used for each user. Instead, a single key pair is used to authenticate the SSH client system and the SSH server trusts the client as to the ide ntity of the individual users.
PAGE 7
Cygwin emulates a UNIX environment. To locate files such as /etc/passwd and /etc/group, and the user’s home directory (for example, /home/), Cygwin sets up mount points. In the registry, navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Cygnus Solutions\Cygwin\mounts v2 Under this registry key the following mount points are defined: /, /home, and /usr/bin. The native key under each of these is set to the corresponding Windows directory.
PAGE 8
HP SIM issues custom commands on the CMS platform from. When you select a custom command to be issued against a set of managed systems, the HP SIM custom command process logs into the platform using SSH and the current HP SIM sign in, and then the process is issued on the CMS platform. The systems list is passed to the DTF through an environmental variable. The custom command then executes against each target system. The target systems do not need to run SSH to function properly.
PAGE 9
Managed system authentication When HP SIM connects through SSH to a managed system, the SSH server on that system returns an SSH host key that identifies that system. HP SIM must decide if this key is acceptable and hence authenticate the managed system. By default, HP SIM 6.x accepts any key, which leaves HP SIM open to certain types of network attacks, such as a man-in-the-middle attack where an imposter pretends to be the managed system.
PAGE 10
The setting used to manage control key checking is in the file /config/mx.properties in Windows and /etc/opt/mx/config/mx.properties in Linux and HP-UX: MX_SSH_ADD_UNKNOWN_HOSTS=firstuse (or ‘always’ or ‘never’) Note: Before modifying this property, you must stop the HP SIM service. After you have modified the property, restart the HP SIM service.
PAGE 11
/config/sshtools/.dtfSshKey.pub in Windows and /etc/opt/mx/config/sshtools/.dtfSshKey.pub in Linux and HP-UX.  User public key authentication is attempted first. The SSH server on the managed system attempts to find a matching public key for the specified user. These keys are normally stored in a file authorized_keys2, which is located in the .ssh subdirectory of the specified user’s home directory. (For Windows, the file location is C:\Documents and Settings\Administrator\.
PAGE 12
Note: You must restart HP SIM after making changes to the Windows Administrator user name. Add this user account to HP SIM with full-configuration-rights and authorizations on all systems, including the CMS, using the Options SecurityUsers and Authorizations menu or the following command: > mxuser –a MyDomain\AlternateAdmin -p full –C Administrator Note: If you run the mxuser command, you must assign the appropriate authorizations to the user by running the mxauth command.
PAGE 13
The OpenSSH install package can run from the HP SIM download or management CD, or you can download it separately from the HP SIM website. After you have run the installer, the system must be configured for access by HP SIM. Either run the Configure or Repair Agents tool on the systems, specifying the administrator or other account to be used by SSH; or perform the following steps: a. Add the user used by HP SIM to the passwd file using the sshuser utility on the managed system.
PAGE 14
Password authentication can be used as an alternative to key-based authentication, for example, if there are problems installing the keys on the managed system. The CMS must be configured with the password to use for the managed system. mxnodesecurity –a –p ssh –c root:mypwd –n SSH files On each managed system configured for SSH, there are the following files:  The SSH server program files  The SSH server private key ssh_host_dsa_key and the corresponding public key ssh_host_dsa_key.
PAGE 15
File type HP-UX Linux Windows Public key authentication authorized_keys2 $HOME//.ssh $HOME//.ssh C:\Documents and Settings\\.ssh or C:\Documents and Settings\hpsimssh\.ssh Host authentication ssh_known_hosts and shosts.
PAGE 16
If the key being presented by HP SIM is listed in the file, the SSH server uses it to encrypt a challenge to return to HP SIM. The SSH server enables the user to sign in provided the response to the challenge is correct. If the public key is not present, the public key authentication fails. While the authorized_keys2 file can be maintained manually, HP SIM provides the mxagentconfig utility to maintain this file.
PAGE 17
Note: The sshuser utility is a new utility included with the OpenSSH supplied by HP SIM 6.x and replaces the mxpasswd command previously available. This utility was not supplied with previous versions of OpenSSH from HP. If not present on the managed system, you can copy it from the HP SIM installation directory (C:\Program Files\HP\Systems Insight Manager\lbin\sshuser.exe).
PAGE 18
mxagentconfig -a -n -u [-p ] –o host This option configures host-based authentication on the managed system. It requires that SSH be installed on the target system and, if the target is a Windows system, the user must be included in the passwd file. It connects to the managed system using password authentication and then uses sftp, as described above.
PAGE 19
After you install the OpenSSH software, the tool configures the installation. The user name is specified when running the tool and the administrator user name (which might have been renamed from Administrator) to the passwd file. The tool then runs mxagentconfig for these users to allow this CMS access through user public key authentication: the public key of the CMS is added to the authorized_keys2 file for each user.
PAGE 20
SSH Keys This tool (OptionsSecurityCredentialsTrusted systemsSSH HostKeys…) controls how HP SIM authenticates managed systems. The managed system’s host keys can be verified against the known_hosts file on the CMS, and you can examine and change the entries in this file. Conclusion HP SIM uses the SSH-2 protocol to issue tasks on managed systems. This requires an SSH server to be running and accepting requests on each managed system on which tasks are issued.
PAGE 21
managed systems, as well as a key management tool (mxagentconfig) for setting up a user with the public key of the DTF. The information contained here gives you an idea of remote task execution in HP SIM and gives you an idea of where to start troubleshooting when there is a problem. Common questions and tasks Changing the port used by SSH Normally, SSH servers listen on TCP port 22. If, for some reason, this must be changed, the SSH port that HP SIM uses is configurable.
PAGE 22
Note: Sometimes a domain policy can prevent HP SIM from adding these rights to the installing user. HP SIM must be installed by a user who has these rights. Installation Diagnostic File for SSH When installation issues for the SSH portion of the HP SIM installation occur, the first location you should look in is the initconfig.log file. This file is located C:\Program Files\HP\Systems Insight Manager\logs and might provide clues.
PAGE 23
Settings directory. The authorized_keys file in this directory provides public key authentication for any user configured to use this directory. Modifying the HP SIM tools You will not normally need to modify the tools included with HP SIM. Tools configured to run as Administrator can run as an alternate user using the steps described earlier in the HP SIM commands and tools. If you need to change the user that is used to run a specific tool, perform the following steps: 1.
PAGE 24
Troubleshooting Diagnostic tool to check SSH setup You can use the mxagentconfig tool to verify whether SSH on the target system is configured properly to be used with HP SIM. This option verifies whether the SSH connection can be successfully authenticated for the specified user using the HP SIM user public key and host -based authentication methods. If the authentication is successful, HP SIM can issue tools on the target system.
PAGE 25
authorizations to ensure that this user is a valid HP SIM user and is authorized to run tools on the CMS. 3. Is the OpenSSH server installed and working correctly? Verify that OpenSSH is installed on the target system and that the service OpenSSH Server is running. You can use the Install OpenSSH tool to install the software on a managed system. If it is installed but not running, look for errors from the OenSSH or SSH applications in the system application log.
PAGE 26
5. Is OpenSSH configured to allow access from HP SIM? Use the ConfigureConfigure or Repair Agents tool to configure SSH on the managed system. Select the checkbox to configure SSH access. This tool sets up the passwd file and host or user public key authentication for the user name specified in this task. Continue with the following steps to verify its operation. 6. Is the passwd file correctly set up? If you failed to log in using ssh, verify the passwd file.
PAGE 27
MyAdmin:unused_by_nt/2000/xp:500:513:U-BRIAN06\MyAdmin,S-1-5-211148942700-1292286586-3675345140500:/home/Administrator:/bin/switch If the information is not correct, use sshuser to add the user and repeat the SSH test from step 3. 7. Is the user configured for SSH access? Use mxagentconfig to configure the user name for remote access using user public key authentication. Use mxagentconfig –c to verify the configuration.
PAGE 28
Status :Complete Exit Code :0 STDOUT : Volume in drive C has no label. Volume Serial Number is FC11-1248 Directory of C:\Documents and Settings\Administrator 07/09/2005 07/09/2005 05/10/2005 05/10/2005 05/10/2005 07/12/2005 07/09/2005 04/07/2005 06/22/2005 05/10/2004 07:53p
. 07:53p .. 05:53p .java 05:53p .jpi_cache 06:06p 1,516 .plugin141_04.trace 05:48p .
PAGE 29
3. Is the OpenSSH server installed and working correctly? Verify that OpenSSH is installed on the target system and that the sshd daemon is running. You can verify operation of the SSH server using the SSH command-line utility. This is shipped with OpenSSH and enables interactive login using SSH. Try to log in using the user name from step 1. CMS> ssh root@mysystem Password: **** Last login: Thu Jul 14 16:31:49 2005 from mysystem.hp.
PAGE 30
This tool sets up the passwd file and host or user public key authentication for the user name specified in this task. Continue with the following steps to verify its operation. 6. Is the user configured for SSH access? Use mxagentconfig to configure the user name for remote access using user public key authentication. Use mxagentconfig –c to verify the configuration.
PAGE 31
ii. iii. iv. v. b. On i. ii. Enter the following: copy .dtfSshKey.pub authorized_keys2. Log into the remote system and change to the user name’s home directory (as specified in the passwd file) . If not present, create an .ssh directory. Copy the authorized_keys2 file from the CMS into the .ssh directory.
PAGE 32
CMS> mxagentconfig -a -n blade08 -u administrator Problem: “There was a problem connecting to the HP SIM server” CMS> mxagentconfig -c -n blade08 -u administrator There was a problem connecting to the HP SIM server. Make sure that: 2. 3. 4. 5. Your user name was added to HP SIM. Your user name and password, if specified, are spelled correctly. HP SIM is running. You used '--' for any long options and double quotes if your user name includes a domain.
PAGE 33
Mydomain\MyUser@targethost’s Password:**** because you do not have sufficient privileges. Be sure that the specified user is a direct member of the Administrators group on the target system and remember that membership of a domain group is not sufficient for OpenSSH.
PAGE 34
Problem: An MxAuthenticationException is generated when a tool is run, either from the GUI or the command line interface. Solution: Follow the steps listed in Checklist to debug SSH on Windows or Checklist to debug SSH on Linux or HP-UX sections Problem: When executing a task, the message Unknown OS appears. Solution: The installation might not have been completed properly. 1. If you are trying to execute a task on a Windows system, make sure that it rebooted after SSH installation.
PAGE 35
sshuser –u joe –d MyDomain –f "C:\Program Files\OpenSSH\etc\passwd"  The user name must be configured for user or host based authentication: mxagentconfig –a –u mydomain\joe –n localhost
PAGE 36
Appendix A: Changes in HP SIM 5.x HP SIM        36 5.x includes a number of improvements to SSH handling: Improved error reporting to make troubleshooting easier Support for host-based and password authentication, in addition to user-based authentication A new utility, sshuser, for Windows systems replaces the mkpasswd tool. o This new tool resolves issues with domain users (the domain name is now included as part of the user name).
PAGE 37
Appendix B: Tool examples This section provides examples of MSA and SSA tools available in HP SIM. MSA tools Category Tool name Description Command Line Tools PostgreSQL DB Backup Back up the Systems Insight Manager PostgreSQL database. Configuration Tool Subscribe to WBEM Events, Unsubscribe to WBEM Events Configure a managed system to send WBEM indications to HP SIM. Resource Management Process Resource Manager Console Run the Process Resource Manager for managing system resources.
PAGE 38
Category Tool name Description Resource Management Display Resource Usage Display the current Process Resource Manager resource usage. Resource Management Event Monitoring Service Configure and view resource monitoring requests on the managed system. Resource Management List Resource Availability List Process Resource Manager resources available. Software Management CLI List Software Example tool that runs Software Distributor (SD) swlist command on each system.
PAGE 39
GUI — graphical user interface. For example, the web-based portal interface to HP SIM. host key — The public key that proves the identity of a particular host. IETF — Internet Engineering Task Force. From the IETF Web page: “The Internet Engineering Task Force (IETF) is a large, open international community of network designers, operators, vendors, and researchers concerned with the evolution of the Internet architecture and the smooth operation of the Internet.
PAGE 40
For more information  HP Systems Insight Manager www.hp.com/go/hpsim  IETF secsh working group home page www.ietf.org/html.charters/secsh-charter.html  SSH and OpenSSH www.openssh.org  For power users, HP recommends the O'Reilly reference: Daniel J. Barrett, Richard E. Silverman, Robert G. Byrnes, SSH: The Secure Shell, The Definitive Guide, 2005. The book is available at http://www.snailbook.com/. Technology for better business outcomes © 2010 Hewlett-Packard Development Company, L.P.