SSH Protocol

By default an SSH agent uses port 22. If you are using a different port for SSH, enter that port number.

Time-out in milliseconds after which the Probe stops trying to connect to the remote machine.

For the UNIX platform: If your server is slow, it is recommended to change Timeout to 40000.

The handshake timeout (in milliseconds).

SSH2. Connect through SSH-2 only.

SSH1. Connect through SSH-1 only.

SSH2 or SSH1. Connect through SSH-2 and in case of error (if SSH-2 is not supported by the server), try to connect through SSH-1.

The character that separates different commands in a shell (to enable the execution of several commands in the same line).

• For UNIX, the default shell command separator is a semicolon (;).
• For Windows, the shell command separator is an ampersand (&).
• For Cygwin, select auto detect.

Choose one of the following authentication options to access SSH:

• password. Enter a user name and password.

• publickey. Enter the user name and path to the key file that authenticates the client.

  See also: How to Create an SSH Connection Based on Public/Private Keys Pair

• keyboard-interactive. Enter questions and answers. For details, see SSH Protocol below.

The name of the user needed to connect to the host through the SSH network protocol.

The password of the user needed to connect to the host.

(Enabled when the publickey authentication method is selected.) Location of the authentication key. (In certain environments, the full key path is required to connect to an SSH agent.)

See also: How to Create an SSH Connection Based on Public/Private Keys Pair

(Enabled when the keyboard-interactive authentication method is selected.) A method whereby the server sends one or more prompts to enter information and the client displays them and sends back responses keyed-in by the user.

The following is an example of prompts and expected responses:

Prompt: Please enter your user name.

Response: Shelly-Ann

Prompt: What is your age?

Response: 21

Prompt: This computer is HP property. Press y to enter.

Response: y

To create these prompts and responses, enter the following strings in the fields, separated by commas:

Prompts: user,age,enter

Response: Shelly-Ann,21,y

You can enter the full string as it appears in the SSH prompt, or you can enter a key word, for example, user. DFM maps this word to the correct prompt.

Enabled when CyberArk integration is enabled. Select this radio button to use regular credential as before.

• Username. See description above.

• Password. See description above.
  

Enabled when CyberArk integration is enabled. Select this radio button to use an external credential vault.

• Type. The external vault type. Currently only CyberArk is supported.

• Reference. Click to open the Configure dialog box.

  • Reference. Select this option to configure the Reference ID that will be used by UCMDB/UD to retrieve the passwords from the CyberArk Enterprise Password Vault when they are needed.

    Set the reference ID in the CyberArk Enterprise Password Vault in the following format: <Safe Name>\<Folder Path>\<Reference ID>.

    Where <Safe Name> is the Safe value in CyberArk, <Folder Path> is the folder where the Safe belongs to, and <Reference ID> is the name of the CyberArk account you specified or auto-generated in CyberArk.

    For example, NancySafe\Root\nancy-cyberark-testing-refid.

  • Parameter. Select this option to enable configuring a list of editable CyberArk properties as a query string for UCMDB/UD to retrieve passwords from the CyberArk Enterprise Password Vault.

    To configure a CyberArk property value, click in the Value column for the property, and specify the value in string.

    The CyberArk properties values must not contain any of the following characters: \/:*?"<>|'.;

    The out-of-the-box list of CyberArk properties displayed in the Configure dialog box is editable. You can set selected CyberArk properties as the default list using JMX method setGlobalSettingVaule. For instructions, see "How to Set a Default List of CyberArk Properties Using JMX" in the HPE Universal CMDB Data Flow Management Guide.

    • Regex. Enables configuring CyberArk properties values in regular expressions.

      For examples of how to use regular expression syntax, see "Regular Expression Examples" in the HPE Universal CMDB Modeling Guide.

      The CyberArk properties values in regular expression must not contain any of the following characters: : ;

Select one of the following options:

• Privileged Mode. Enables you to run commands in a privileged shell environment, after entering a privileged shell.

• Sudo-like. Enables you to run commands in privileged command execution mode by using a specified prefix before the target command.

• Privileged Mode or Sudo-like. A combination of both of the above options.

Based on your Policy selection, select the Mode.

For Privileged Mode, select one of the following options:

• Su. DFM executes the su command and enters the password at the prompt to enter the privileged shell, then executes the required command, and then executes exit to exit the privileged shell.

• Enable. DFM executes the enable <level> command and enters the password at the prompt to enter the privileged shell, then executes the required command, and then executes the disable <previous_level> command to exit the privileged shell (where <level> represents the selected privileged mode level and <previous_level> represents the original level before running the enable command).

• Custom. DFM executes the user-defined Enter command and enters the password at the prompt to enter the privileged shell, then executes the required command, and then executes the user-defined Exit command to exit the privileged shell.

For Sudo-like, select one of the following options:

• Sudo. DFM executes the sudo command followed by the required command and then enters the password at the prompt.

• Custom. DFM executes the user-defined Command line followed by the required command and then enters the password at the prompt.

For Privileged Mode or Sudo-like, select an option in each panel.

When you select Privileged Mode as the policy and Su as the mode, the following fields are relevant:

• Username. Enter the user name for the su command.

• Password. Enter the password for the su command.

• Command List. See Command List.

When you select Privileged Mode as the policy and Enable as the mode, the following fields are relevant:

• Level. Enter the privileged mode level for the enable command.

  Note Entering an empty value selects the highest level, 15.

• Password. Enter the password for the enable command.

• Command List. See Command List.

When you select Privileged Mode as the policy and Custom as the mode, the following fields are relevant:

• Enter Command. Command used to enter privileged command execution mode. For example:

  • for enable: enable 10
  • for su: su root

• Exit Command. Command used to exit privileged command execution mode. For example:

  • for enable: disable 5
  • for su: exit

• Password Prompt. The prompt string that appears after entering the privileged command execution mode. For example:

  • for both enable and su: Password:

• Password. Enter the password to use when the password prompt appears.

• Command List. See Command List.

When you select Sudo-like as the policy and Sudo as the mode, the following fields are relevant:

• Sudo Paths. Enter the full paths to the sudo command. Paths should be separated by commas.

• Command List. See Command List.

When you select Sudo-like as the policy and Custom as the mode, the following fields are relevant:

• Command Line. Enter the full command line before the target command to be executed in privileged mode. For example:

  • for sudo: /usr/bin/sudo
  • for pbrun: /bin/pbrun

• Command List. See Command List.

Enter a list of commands that can be executed with the current policy/mode selection. Commands must be separated by commas. This field accepts a sudo command that prompts for the user's password.

You can select commands by pattern matching and pattern completion using Python/Jython regular expressions. For example, entering .*uname would select all of the following expressions:

• /usr/sbin/uname

• uname -a

• uname -r

• /mypath/my_other_path/uname -my args -my other args