3.1.6 SSH connection setting method for Windows (when the PFM - RM host is running Windows and the monitored host is running UNIX)

(1) Enabling the SSH server's public key authentication

To enable public key authentication:

1. Log on to the monitored host as a superuser.

2. Open /etc/ssh/sshd_config^#.

3. Change PubkeyAuthentication to yes.

4. Save and close /etc/ssh/sshd_config^#.

5. Execute the following command to start the sshd service:

   • For Linux 7, SUSE Linux 12, or SUSE Linux 15

   [root@TargetHost.ssh]$ systemctl restart sshd.service

   • For other OSs

   [root@TargetHost.ssh]$ /etc/rc.d/init.d/sshd restart

   Note

   To log on as a superuser to collect information, open /etc/ssh/sshd_config^# and change PermitRootLogin to yes. After that, restart the sshd service.

   #

   This will be /opt/ssh/etc/sshd_config when using HP-UX.

To Page Top

(2) Creating keys

This subsection explains the procedure for creating keys.

Log on to the PFM - RM host and create a key by using the functionality provided by the SSH client.

- When using PuTTY as the SSH client

You can select RSA or DSA encryption for the key type. The only difference between RSA and DSA encryption is the encryption algorithms; their operation methods are the same.

The following example shows how to create RSA keys.

1. From the Windows Start menu, choose All Programs, PuTTY, and then PuTTYgen.

   The PuTTY Key Generator window appears.

2. Under Parameters, make sure that SSH-2 RSA is selected for Type of key to generate, and then click the Generate button.

   A progress bar showing the key generation progress is displayed in Key.

   Because PuTTY uses version 2 of the SSH protocol as the default, SSH-2 RSA is selected. For details about how to change the default used to version 1 of the SSH protocol, see the documentation for PuTTY.

3. Until the progress bar reaches 100%, randomly move the mouse in the dialog box to generate random numbers necessary for creating a key.

   When the progress bar reaches 100%, the generated random numbers are displayed in Key and a key is generated.

4. Click the Save private key button to save the private key.

   If you did not enter any value in Key passphrase or Confirm passphrase, a dialog box still appears. Do not enter any value in Key passphrase or Confirm passphrase and click the Yes button.

5. Click the Save public key button to save the public key.

- When using OpenSSH (supplied with Windows Server 2019) as the SSH client

In this case, only RSA encryption is available for the key type. The following example shows how to create keys.

1. Log in to the PFM - RM host.

2. Execute the ssh-keygen -t rsa command.

3. Determine the destination and name of the private key.

   By default, %userprofile%\.ssh\id_rsa is set.

4. Press the Enter key twice.

   When you are asked to enter a pass phrase for the private key, press the Enter key without entering anything. When re-entry is prompted, press the Enter key again without entering anything.

The following shows an example of ssh-keygen -t rsa command execution:

C:\work>ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (C:\Users\user-name\.ssh\id_rsa): <Enter>
Enter passphrase (empty for no passphrase): <Enter>
Enter same passphrase again: <Enter>
Your identification has been saved in C:\Users\user-name\.ssh\id_rsa.
Your public key has been saved in C:\Users\user-name\.ssh\id_rsa.pub.
The key fingerprint is:
SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx user-name@PFM-RM-host-name

To Page Top

(3) Placing the public key on the monitored hosts

Place the created public key on the monitored host. If there are multiple monitored hosts, distribute the key to all of them.

[ClientUser@TargetHost ~]$ cd .ssh
[ClientUser@TargetHost .ssh]$ ssh-keygen -i -f agt7.pub >> authorized_keys
[ClientUser@TargetHost .ssh]$ rm agt7.pub
[ClientUser@TargetHost .ssh]$ chmod 600 authorized_keys

[ClientUser@TargetHost ]$ cd .ssh
[ClientUser@TargetHost .ssh]$ cat id_rsa.pub >> authorized_keys
[ClientUser@TargetHost .ssh]$ rm id_rsa.pub
[ClientUser@TargetHost .ssh]$ chmod 600 authorized_keys

To Page Top

(4) Checking the connection and registering a fingerprint

To check whether the PFM - RM host and a monitored host can connect to each other:

1. Log on to the PFM - RM host by using the value that was specified in RMHost_User during instance environment setup.

   To use common account information, log on to the PFM - RM host by using the value that is specified in User in common account information (pfmhost).

2. Start the command prompt.

3. Using the created private key, execute the following command on the monitored host to start the connection process:

   - When using PuTTY as the SSH client

   plink command provided by PuTTY

   - When using OpenSSH (supplied with Windows Server 2019) as the SSH client

   ssh command provided by OpenSSH

4. During the initial connection, register a fingerprint.

   Register the fingerprint of the public key on the monitored host. Here, enter y. When you enter y, the monitored host's command prompt appears.

5. From the monitored host's prompt, execute the exit command to log out from the monitored host.

6. From the PFM - RM host, execute the following command on the monitored host to reconnect to it.

   - When using PuTTY as the SSH client

   plink command provided by PuTTY

   - When using OpenSSH (supplied with Windows Server 2019) as the SSH client

   ssh command provided by OpenSSH

   If the monitored host's prompt appears in subsequent connections without you having to enter any information, setup of the connection between the PFM - RM host and the monitored host is completed. From the monitored host's command prompt, execute the exit command to log out from the monitored host.

   If an error occurs or if you are asked to enter anything, check to see if you have correctly followed the procedure.

A setting example for checking connection follows:

- When using PuTTY as the SSH client

C:\WINDOWS\system32>"C:\Program Files\PuTTY\plink.exe" -ssh -noagent -i "C:\Program Files\PuTTY\agt7.ppk" -P 22 ClientUser@TargetHost
The server's host key is not cached in the registry. You
have no guarantee that the server is the computer you 
think it is.
The server's rsa2 key fingerprint is:
ssh-rsa 2048 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
If you trust this host, enter "y" to add the key to
PuTTY's cache and carry on connecting.
If you want to carry on connecting just once, without
adding the key to the cache, enter "n".
If you do not trust this host, press Return to abandon the
connection.
Store key in cache? (y/n) y
Using username "ClientUser".
Last login: Wed Aug  4 13:29:55 2010 from xxx.xxx.xxx.xxx
[ClientUser@TargetHost]$ exit
logout
C:\WINDOWS\system32>"C:\Program Files\PuTTY\plink.exe" -ssh -noagent -i "C:\Program Files\PuTTY\agt7.ppk" -P 22 ClientUser@TargetHost
Using username "ClientUser".
Last login: Wed Aug  4 13:30:00 2010 from xxx.xxx.xxx.xxx
[ClientUser@TargetHost]$ exit
logout
C:\WINDOWS\system32>

- When using OpenSSH (supplied with Windows Server 2019) as the SSH client

C:\Users\user-name\.ssh>ssh -i "C:\Users\user-name\.ssh\id_rsa" -p 22 ClientUser@TargetHost
The authenticity of host '[xxx.xxx.xxx.xxx]:22 ([xxx. xxx. xxx. xxx]:22)' can't be established.
RSA key fingerprint is SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[xxx.xxx.xxx.xxx]:22' (RSA) to the list of known hosts.
Last login: Wed Sep 25 09:08:14 2019 from xxx.xxx.xxx.xxx
[ClientUser@TargetHost]$ exit
logout
C:\Users\user-name\.ssh>

Notes:

• PFM - RM for Platform assumes that fingerprint registration has already been completed. Because you can register a fingerprint during the initial SSH client connection, we recommend that you complete the procedure described here at that point.

• If you change the user account specified for RMHost_User during the instance environment setup, you need to re-register a fingerprint. If you are using common account information, you also need to re-register a fingerprint when updating the value of User in common account information (pfmhost).

• If you run PFM - RM for Platform in a cluster system, register a fingerprint on the standby node in the same way as on the executing node.

• Confirm that a response is returned in less than 10 seconds when you execute a command such as uname on the monitored host from the PFM - RM host.

• When you use OpenSSH (supplied with Windows Server 2019) as the SSH client, a connection attempt might fail if users other than those specified as RMHost_User in the instance setting have access to the private key file. In this case, select Properties - Security - Advanced in the private key file to delete the permissions of users other than those specified as RMHost_User.

For details about PFM - Manager startup, see the chapter that describes startup and termination of Performance Management in the JP1/Performance Management User's Guide.

To Page Top