After successful SSH authentication Linux Discovery failing (gMSA MID Server + SSH Private Key)

[SiddiqB]

Hi Team,

I am facing an issue with Linux Discovery using SSH Private Key via a gMSA-based Windows MID Server.

1. Current Setup

• MID Server: AWSMID (running with gMSA account - windows mid server)
• Authentication: SSH Private Key
• Target: Ubuntu 22.04 server
• SSH Key format: RSA (BEGIN RSA PRIVATE KEY)
• Credential configured in ServiceNow

2. Validation Results

• Manual SSH from MID server (PowerShell):

ssh -i "C:\SSH\sn_mid_rsa" mid_account@<IP> ( 

Successfully connects)

3. ServiceNow Credential Test:  Credential validated successfully

4. Discovery starts but fails during classification.

Errors observed in Discovery log:

• SSHTerminalInteractiveCommand: failed to execute
• cli_commands: show vmdevice
• Active, couldn't classify, now finished
• SSH authentication or connection failure

5. MID Server Log Errors

Found repeated errors like:

• Cloud credentials are missing 
• Unable to generate temporary credentials
• sts:AssumeRole → AccessDenied

[shubhamseth]

@SiddiqB As per me, you can give try on below: 

The issue is most likely caused by the SSH shell session not being fully interactive for Discovery command execution, even though authentication is successful.

Main indicators:

• Manual SSH works

• Credential test passes

• Discovery fails during classification

• Error:
  SSHTerminalInteractiveCommand: failed to execute

This commonly happens in gMSA-based Windows MID setups when:

• the MID Server Java service cannot properly use the SSH private key/session for interactive command execution

• or the Linux account does not allow proper PTY/sudo/shell execution required by Discovery

Exact Fix / Solution

1. Configure Passwordless Sudo for Discovery Account

On Ubuntu server:

sudo visudo

Add:

mid_account ALL=(ALL) NOPASSWD: ALL

---

2. Ensure Shell is Bash

Run:

grep mid_account /etc/passwd

Shell should be:

/bin/bash

NOT:

• /sbin/nologin

• restricted shell

---

3. Enable PTY in SSHD

Edit:

/etc/ssh/sshd_config

Ensure:

PermitTTY yes

Then restart SSH:

sudo systemctl restart sshd

---

4. Give gMSA Read Access to Private Key

On MID Server:

• Ensure MID Server service account (gMSA) has read access to:
  C:\SSH\sn_mid_rsa

---

5. Retry Discovery

After changes:

• Restart MID Server service

• Clear old Discovery status

• Re-run Discovery

Important Note

The AWS AssumeRole AccessDenied errors are unrelated cloud credential issues and NOT the root cause of Linux Discovery failure.

Hope this helps.