[Q&A] GLPI Agent runs remoteinventory task with no errors, but it fails to show up on server

[bazgab]

Documentation & bug reporting acknowledgment

Yes, I read it

Describe your problem

Hi all,

We are running the GLPI Agent for the remote inventory capability and so far had success registering virtual machines from our Proxmox nodes without a problem, however today I tried to run the same task I've been running on all other PVE nodes and for some reason some nodes now don't show up on our server, eventho the Agent returns no errors at all, does anyone know what that might be? Thank you.

root@sfy-glpi-prod-agent-01:~# glpi-agent  --remote=ssh://root@{REDACTED}/?mode=ssh --tasks remoteinventory
[info] target server0: server https://suporte.solvefy.cloud
[info] sending contact request to server0
[info] sending prolog request to server0
[info] running task RemoteInventory
root@sfy-glpi-prod-agent-01:~#

[g-bougard]

Hi @bazgab

to see what can happen, first add --debug --debug on the commandline to enable debug=2 level.

[g-bougard]

Here I just see it always fails to authenticate via libssh2, and then switch on using ssh. Before these failing lines, did it use libssh2 ? I mean did you see other lines than "executing ssh ..." which means it uses "ssh" mode and so not "libssh2" mode.

If each command takes a long time, glpi-agent can decide to retry "libssh2", and fallback on "ssh" in your case.

I think libssh2 doesn't work for this computer since the beginning but you missed that point.

[bazgab]

No it never used libssh2, since the very beginning of the command it just fails, I checked for libssh2 with a simple dpkg -l | grep libssh2 on both the agent host and the VM host, and both show the package installed, so I'm not sure why it's not authenticating via libssh2.

[g-bougard]

For your information, libssh2 is not required on remotes being inventoried, only a ssh server is required.

Libssh2 is like ssh command, just a client for a sshd server. You may have configured your ssh environment so ssh command work but libssh2 doesn't. For example, if you uses ~/.ssh/config to configure an access, libssh2 won't use it directly and may miss an important parameter. As example, if you configured a port for remote host, you'll have for libssh2 to set it in "ssh://" url.

But in your case, I can see glpi-agent doesn't try any publickey authentication. So how your authentication is configured for ssh ? Do you have some specific parameters ?

Sometime, there also can be some incompatibility. I don't know exactly how to dig this possible case.

[bazgab]

we have a company-wide directory with everyone's authorized keys in ~/.ssh/authorized_keys.d, one of the subdirectories has the VMs we use for the GLPI Agent. This is configured in /etc/ssh/sshd_config/custom_sshd.conf to allow the pulling of public keys in every machine in our clusters.

The steps I do now to ensure that a VM gets inventoried are:

1. Ensure the target VM has the GLPI-Agent Host VM public key in ~/.ssh/authorized_keys.d/glpi-publickey
2. Ensure the network interfaces between the clusters allow for connection
3. Ensure firewall properties allow for connection through iptables
4. Run command: glpi-agent --remote:ssh://root@{target VM IP}/ --tasks remoteinventory

[g-bougard]

1. Ensure the target VM has the GLPI-Agent Host VM public key in ~/.ssh/authorized_keys.d/glpi-publickey

Here is probably the reason why libssh2 doesn't find your public keys. When using libssh2, glpi-agent will only check for private and public keys available under ~/.ssh, not under any subfolder.

So if you have a dedicated key for remote access, you should probably install it in the parent folder, maybe with a symbolic link: used private and public keys must be installed there for libssh2 support.