Discovery Credentials: SSH Private Key

chadlockwood · ‎06-06-2014

Currently, Discovery is configured to use a local account username and password for SSH to our Macs. Discovery is successful with this configuration, however, it is not the most secure option. We are attempting to use an SSH Private Key type credential for discovery of our Mac machines without success.

I have tried generating a key pair on the Mac and entering the private key data into the Credentials form.

I have tried generating a key pair on the MID server, adding the public key to the ~/.ssh/authorized_keys file on the Mac, and entering the MID server private key data into the Credentials form. Neither of these were successful.

I was able to successfully SSH from the MID server to the Mac using Putty, after copying the MID server public key to the Mac.

Is anyone using the SSH Private Key to successfully Discover Unix-based machines, that could help with configuration?

Regards,

Chad Lockwood

chadlockwood · ‎06-11-2014

The following process worked in my environment. You will need a service account on your endpoints and a public/private key pair for each of your MID servers before you can configure the SSH Private Key credential in ServiceNow:

Service Account
1. Setup a service account on your endpoint that has administrative privileges
2. Use a central management tool or sneakernet/intern-net to push the service account to all endpoints
Create the public/private key pair on the MID server
1. If your MID server is running on a Windows machine, use PuTTYgen to generate your key pair. This is a great link for setting up PuTTY
2. If your MID server is running on Linux/Unix, look at using ssh-keygen to generate your key pair
Copy your MID server public key to your endpoints
1. The public key will need to be saved in $HOME/.ssh/authorized_keys for your service account
Create a new credential record in ServiceNow
1. ServiceNow only supports PEM file private keys. Using PuTTYgen, follow these directions to convert your private key to PEM
2. ServiceNow > Credentials > New
  1. Name: Enter a descriptive name
  2. Type: SSH Private Key
  3. User name: username of the service account on the endpoint
  4. SSH passphrase: the passphrase used to generate the public/private key pair on the MID server
  5. SSH private key: copy the entire contents of the PEM file private key from your MID server
  6. Applies to: Specific MID servers
  7. MID servers: select the MID server that this key pair was generated on
  8. Click Save
You will need to repeat this process for all MID servers used in Discovery

Starting with Dublin, you can add a sudo password, if required. We are on Calgary so that field is not available to us. This would defeat the purpose of using the key pair for my requirements so we are not likely to use it after we upgrade. The alternative would be to use the NOPASSWD option. Hope this helps.

View solution in original post

SNFan · ‎04-20-2016

Are you sure about this? ISnt the private key agnostic of the MID..It gets loaded into the Credential table..Any MID can use (AFAIK)

kvamsikrishna · ‎11-16-2016

Hi Prasanna

There is no problem if u assign all mid servers

if u want to assign a particular mid server, you can assign

Alvaro Paronuzz · ‎04-30-2024

Hello,

can this be used if my target host is on Google Cloud Platform (GCP)?

Gurusankar · ‎07-11-2020

Hi Chad,

Even after following all these steps, I am unable to establish the connection with my lab linux server.

Error :Authentication failed

Steps Followed:

1. Created SSH Key pair using puttykeygen

2. Created a "disco" user in destination machine and copied public key to /home/disco/.ssh/authorization_keys of my destination linux machine.

3. Copied the private key to my discovery instance credential page with user name "disco" and port number 22

4. When I perform Credential test the connection is failed with Authentication failed message

Please could you advise anything I need to change it at MID Server, my MID server is running on a windows machine.

Thank you.

Regards,

Guru R

imranbasha1 · ‎11-30-2021

Hi, Are we still follow this these step for SHH Authentication, is internal linux team will share this information to us