Would it be possible to use GLPI Remote Inventory with SSH-keygen on Linux?

[psl2024]

Documentation & bug reporting acknowledgment

Yes, I read it

Describe your problem

Hello everyone!

I am new to using GLPI, and I am currently trying to use the GLPI Remote Inventory. Based on the documentation, administrative privileges are required for this setup. Would it be possible to use this with SSH-keygen?

I am trying to use it with this command, but I am encountering an error.
Command: glpi-remote add ssh://[email protected] --target server0
Error: [error] Can't authenticate on x.x.x.x remote host

If possible, please help me fix this issue. If not, how can I integrate the SUDO command into the command?

Thank you so much!

[g-bougard]

Hi @psl2024

indeed, this is fully possible and I'm using it myself this way. The problem remains to setup the public key authentication in glpi-agent running environment.

If you run glpi-agent as a service, you probably have to setup you key under /root/.ssh. You can also test manually your configuration, but you need to test with the same rights than the agent.

You can also use .ssh/config to tune your accesses. You can ever with this file use different keys for different remote hosts. This is very powerful. Check man ssh_config to explore all the features of file file.

Remember also you can use ToolBox to simplify RemoteInventory usage: https://glpi-agent.readthedocs.io/en/latest/plugins/toolbox-plugin.html

[psl2024]

Hi @g-bougard

Yes, I also validated it using ssh [email protected] and confirmed that there was no login interaction. Then I ran the command above, and the same error was shown.

[g-bougard]

First of all, are you using the latest glpi-agent version ? The latest is 1.8.

Then you can try to add --debug --debug option on your glpi-agent commandline to have more debug.

[psl2024]

Hi @g-bougard

Yes, my GLPI-agent version is 1.8.

I also ran the command with --debug --debug, and here's the part where the error is shown.

[info] running task RemoteInventory
[debug2] Using libssh2 1.8.0 for ssh remote
[debug2] [libssh2] Connecting to 'x.x.x.x' remote host...
[debug2] [libssh2] Check remote host key...
[debug2] [libssh2] Trying publickey authentication using id_rsa key...
[error] [libssh2] Can't authenticate on x.x.x.x remote host
[debug2] executing ssh -q -o BatchMode=yes -l root -o ConnectTimeout=180 x.x.x.x LANG=C id -u
[debug2] executing ssh -q -o BatchMode=yes -l root -o ConnectTimeout=180 x.x.x.x LANG=C cat '.glpi-agent-deviceid'

---

[debug2] Using libssh2 1.8.0 for ssh remote
[debug2] [libssh2] Connecting to 'x.x.x.x' remote host...
[debug2] [libssh2] Check remote host key...
[debug2] executing ssh -q -o BatchMode=yes -l root -o ConnectTimeout=180 x.x.x.x LANG=C cat '/root/.ssh/id_rsa'
[debug2] executing ssh -q -o BatchMode=yes -l root -o ConnectTimeout=180 x.x.x.x LANG=C cat '/root/.ssh/id_rsa.pub'
[debug2] executing ssh -q -o BatchMode=yes -l root -o ConnectTimeout=180 x.x.x.x LANG=C cat '/root/.ssh/known_hosts'
[error] [libssh2] Can't authenticate on x.x.x.x remote host
[debug2] executing ssh -q -o BatchMode=yes -l root -o ConnectTimeout=180 x.x.x.x LANG=C ps -A -o ...
[debug] Running GLPI::Agent::Task::Inventory::Generic::Remote_Mgmt
[debug] Running GLPI::Agent::Task::Inventory::Generic::SSH
[debug2] executing ssh -q -o BatchMode=yes -l root -o ConnectTimeout=180 x.x.x.x LANG=C cat '/etc/ssh/sshd_config'
[debug2] executing ssh -q -o BatchMode=yes -l root -o ConnectTimeout=180 x.x.x.x LANG=C ssh-keyscan -T 1 127.0.0.1
[debug] Running GLPI::Agent::Task::Inventory::Generic::Screen

[g-bougard]

So indeed, it works, the remaining error [error] [libssh2] Can't authenticate on x.x.x.x remote host is only related to the libssh2 support which seems to fail and then glpi-agent fallback on using ssh command directly.

You have few choice about this error:

1. just ignore it
2. update libssh2 to a newer version as the remote host probably doesn't support communicating with it. But this may require to use a more recent linux OS.
3. force to use only ssh mode by adding to your ssh url ?mode=ssh to have --remote option looking like: --remote="ssh://[email protected]?mode=ssh"

[psl2024]

This is now working. Thank you @g-bougard for your assistance.