Discovery SSH Private Key Credential not adhering to Passphase/Key when validating on host

Matthew Saario
Tera Contributor

‎06-25-2019 05:07 AM

I've setup a SSH Private Key in the credential table, with a username, passphrase and SSH Private key.

But when I save the record, it populates the password field as well.

When I got to test the credential against a unix/linux machine it fails, as it's trying to use the username/password combination.

I've turned on logging, but can't find anything in the logs.

Any suggestions?

Thanks inadvance

Labels:
0 Helpfuls
  • 1,732 Views
2 REPLIES 2

tim_broberg
ServiceNow Employee
ServiceNow Employee

‎06-25-2019 08:52 AM

I expect what you're seeing is that the fields get encrypted after you submit the form, but the field remains blank.

I know that for private keys, the password will only be used in response to a password prompt from sudo (or pbrun, dzdo, etc) after you're already authenticated.

Crypto and auth stuff like this is terribly frustrating because, no matter what you get wrong, it fails in exactly the same way. The symptoms don't point to the cause at all.

Some things to try:

  1. If you're generating the private key with Putty, convert it to openssh format.
  2. Look in the ecc_queue input for the credential debug messages and confirm that it really is trying the credential you think it is.
  3. Look in that ssh debug (you're using sncssh, not j2ssh, right?) and confirm that it is actually making auth requests not failing before that in kexinit.
  4. While you're in the debug, confirm that it didn't authenticate and then hang up.
  5. Confirm that you can login to the same server with the same key using your normal ssh client.
  6. Try logging into a different server with the same key.
  7. You can try setting debug level to debug3 in the server and looking in /var/log/secure (assuming a Linux server with openssh) and see all the messages about the failure from the server's perspective. It's probably just going to tell you what you already know, but desperate times call for desperate measures.
  8. Walk thought all the steps with a coworker explaining what you're doing to think it through together.
  9. Take a lunch break, possibly including beer.

Best of luck. I know what a pain debugging credential issues is.
    - Tim.

Vini
Giga Guru

‎06-25-2019 11:47 AM

Hi Saario,

 

We have been discovering Unix & Linux Ci's through SSH Private key method. It is expected to auto populate "password" field after insert/update SSH Private key. We don't need to update "SSH passphrase" field.

while test credentials/discovery of CI, please make sure to select correct MiD Server and check ports[22 or custom ports] are open.

Hope this Helps, if so mark this as correct answer.

 

Thanks & Regards,

Vinil.

 

 

0 Helpfuls