Discovery Credentials: SSH Private Key

chadlockwood · ‎06-06-2014

Currently, Discovery is configured to use a local account username and password for SSH to our Macs. Discovery is successful with this configuration, however, it is not the most secure option. We are attempting to use an SSH Private Key type credential for discovery of our Mac machines without success.

I have tried generating a key pair on the Mac and entering the private key data into the Credentials form.

I have tried generating a key pair on the MID server, adding the public key to the ~/.ssh/authorized_keys file on the Mac, and entering the MID server private key data into the Credentials form. Neither of these were successful.

I was able to successfully SSH from the MID server to the Mac using Putty, after copying the MID server public key to the Mac.

Is anyone using the SSH Private Key to successfully Discover Unix-based machines, that could help with configuration?

Regards,

Chad Lockwood

chadlockwood · ‎06-11-2014

The following process worked in my environment. You will need a service account on your endpoints and a public/private key pair for each of your MID servers before you can configure the SSH Private Key credential in ServiceNow:

Service Account
1. Setup a service account on your endpoint that has administrative privileges
2. Use a central management tool or sneakernet/intern-net to push the service account to all endpoints
Create the public/private key pair on the MID server
1. If your MID server is running on a Windows machine, use PuTTYgen to generate your key pair. This is a great link for setting up PuTTY
2. If your MID server is running on Linux/Unix, look at using ssh-keygen to generate your key pair
Copy your MID server public key to your endpoints
1. The public key will need to be saved in $HOME/.ssh/authorized_keys for your service account
Create a new credential record in ServiceNow
1. ServiceNow only supports PEM file private keys. Using PuTTYgen, follow these directions to convert your private key to PEM
2. ServiceNow > Credentials > New
  1. Name: Enter a descriptive name
  2. Type: SSH Private Key
  3. User name: username of the service account on the endpoint
  4. SSH passphrase: the passphrase used to generate the public/private key pair on the MID server
  5. SSH private key: copy the entire contents of the PEM file private key from your MID server
  6. Applies to: Specific MID servers
  7. MID servers: select the MID server that this key pair was generated on
  8. Click Save
You will need to repeat this process for all MID servers used in Discovery

Starting with Dublin, you can add a sudo password, if required. We are on Calgary so that field is not available to us. This would defeat the purpose of using the key pair for my requirements so we are not likely to use it after we upgrade. The alternative would be to use the NOPASSWD option. Hope this helps.

View solution in original post

Snehal13 · ‎07-11-2022

Hello All,

Seems that some of you got it working. I have a similar problem at hand -

I am trying to upload a csv file from attachment table to a remote server using private key authentication but I get a authentication failed error as "Adding target to blacklist, No valid credential found for type [SSH Password. SS Private Key]"

I have MID server user and the key in same domain and MID is up and running. The server endpoint, username and key are all valid. Instance certificates are good too

What could be wrong. the error log gives no more details of the issue.