SSH Keys

This topic describes the SSH Keys plugin.

Support

Target devices

The CPM supports remote account management for SSH Keys on the following target devices:

• Solaris Intel 11.2, 11.3

• Solaris SPARC 11.2, 11.3

• RHEL 7.1, 7.4, 7.6, 8.x*, 9.x*

• Debian 11.6*

• Ubuntu 18.04, 22.04*

• Fedora 38*

• Oracle Enterprise Linux 6, 7

• IBM AIX 7.1, 7.3

• HP-UX 11.x

• CentOS 7

• SUSE Linux 12

• OpenSUSE 15.4

• Amazon Linux 2

• VMWare ESXi 6.5, 6.7, 7.0

• FreeBSD 13

*The target device version is only supported when the SSH library is configured to work with the Rebex library. For more information, see Configure FIPS-compliant mode.

Accounts

The CPM supports account management for the following accounts:

■

Unix \ Linux accounts

Platforms

In the PVWA Platform Management page, make sure that the following target account platform is displayed:

• Unix via SSH Keys

Connection Methods

This plugin uses the following connection methods to the remote machine:

• SSH
• SFTP

Actions

The following table lists the supported SSH key management actions for this platform:

Action	Verify
Supported	ü
Permissions	Permission 600 to the SSH Key file. Permission 700 to the folder that contains the SSH Key file.
Action	Change
Supported	ü
Permissions	Permission 600 to the SSH Key file. Permission 700 to the folder that contains the SSH Key file.
Action	Reconcile
Supported	ü
Permissions	When UseSudoOnReconcile is set to No, the reconcile account must use a root user or a power user with root permissions. When UseSudoOnReconcile is set to Yes, the reconcile account must be in the sudoers list. If the reconcile account user authenticates to the target server with a password, on the target machine, in sshd_config, set the PasswordAuthentication parameter to yes.
Action	Delete
Supported	ü
Permissions	Permission 600 to the SSH Key file. Permission 700 to the folder that contains the SSH Key file.

Reconcile Accounts

Action	Reconcile
Supported	ü
Required	ü
Platform	Unix via SSH Unix via SSH Keys If a logon account is used for the reconcile account, or UseSudoOnReconcile is set to Yes, the Unix via SSH Keys platform is not supported.
Permissions	When UseSudoOnReconcile is set to No, the reconcile account must use a root user or a power user with root permissions. When UseSudoOnReconcile is set to Yes, the reconcile account must be in the sudoers list. If the reconcile account user authenticates to the target server with a password, on the target machine, in sshd_config, set the PasswordAuthentication parameter to yes.

Logon Accounts

Action	Logon and reconcile
Supported	ü The logon account of the reconcile account, not of the target account, is used.
Required	û
Platform	Unix via SSH Unix via Telnet
Permissions	SU command must be enabled.

Connection Components

The following connection components can be used with accounts managed by this plugin:

• PSM-SSH

For details, see Operating systems.

Configuration

Prerequisites

• Target machine must support login using SSH Keys.
• When using sudo command, the target machine must support sudo access.
• This plugin requires .NET Framework 4.8. If you are using an older version of the CPM, .NET Framework 4.8 must be installed on the CPM machine as well.

Platform Parameters

Port
Description	The port number of the target device.
Acceptable Values	Positive numeric value between 1 and 65535.
Default Value	22
PublicSSHKeyPath
Description	The path where the file containing the public SSH key is located. Note: Make sure the that the Authorized Keys File defined on the target machine matches the path.
Acceptable Value	~ will be replaced with the home folder. %username% will be replaced with the username.
Default Value	~/.ssh/authorized_keys
BackupFile
Description	Whether the existing file will be backed up before changing the key.
Acceptable Value	False, Off or Disable - To indicate that the file should not be backed up. Otherwise, the file will backed up.
Default Value	True
CommandExecutionTimeout
Description	Number of seconds to wait for each command execution.
Acceptable Value	Positive numeric value between 1 and 1000.
Default Value	30
ConnectionTimeout
Description	Number of seconds to wait for the connection to the target device.
Acceptable Value	Positive numeric value between 1 and 1000.
Default Value	30
UseSudoOnReconcile
Description	Whether to use the sudo command on Reconcile.
Acceptable Value	Yes, No
Default Value	No
StandardPrompt
Description	A regex used to identify the standard prompt.
Acceptable Value	A valid regex.
Default Value	.*\$ ?$|.*\# ?$|.*\> ?$|.*\% ?$|.*\] ?$
PopulateIfNotExist
Description	Whether the file and containing folders are created on Reconcile if they do not exist.
Acceptable Value	Yes, No
Default Value	No

Account Parameters

Required

Address
Description	The IP address or host name of the target device where the file is located.
Acceptable Values	IPv4, IPv6 or hostname.
Default Value
Username
Description	The name of the user on the target device who this password belongs to.
Acceptable Value	String
Default Value

Optional

Port
Description	The port number of the target device.
Acceptable Values	Positive numeric value between 1 and 65535.
Default Value	Port defined in the platform.
Comment
Description	The text to be entered in the comment section of the SSH key file.
Acceptable Value	String
Default Value
PublicSSHKeyPath
Description	The path where the file containing the public SSH key is located. Note: Make sure the that the Authorized Keys File defined on the target machine matches the path. If the account has been on-boarded, the path used will be the path where the file was located when discovered.
Acceptable Value	~ will be replaced with the home folder. %username% will be replaced with the username.
Default Value	PublicSSHKeyPath defined in the platform.
CommandExecutionTimeout
Description	Number of seconds to wait for each command execution.
Acceptable Value	Positive numeric value between 1 and 1000.
Default Value	CommandExecutionTimeout defined in the platform.
ConnectionTimeout
Description	Number of seconds to wait for the connection to the target device.
Acceptable Value	Positive numeric value between 1 and 1000.
Default Value	ConnectionTimeout defined in the platform.
UseSudoOnReconcile
Description	Indication whether to use the sudo command on Reconcile.   UseSudoOnReconcile can be defined in both the Target account and the Reconcile account. In case both are defined, the value from the Reconcile account is used.
Acceptable Value	Yes, No
Default Value	UseSudoOnReconcile defined in the platform.
StandardPrompt
Description	A regex used to identify the standard prompt.
Acceptable Value	A valid regex.
Default Value	StandardPrompt defined in the platform.
PopulateIfNotExist
Description	Whether the file and containing folders are created on Reconcile if they do not exist.
Acceptable Value	Yes, No
Default Value	PopulateIfNotExist defined in the platform.