Configuring HP IMC SSH to Switches

I wanted to get our switch configs backed up into HP IMC. Here’s how to enable SSH on the IMC server so that it can contact switches.

By the way, here’s the manual.
HP Intelligent Management Center Base Platform Administrator Guide

  1. Login to IMC and choose System -> Resource Management -> SSH Template List
  2. Click the ‘Modify’ icon in near the right of the row on the ‘default’ template. Alternatively, you can create a new template.
  3. Add your username\password\port info into the template then save.
  4. Navigate to System -> System Configuration -> System Settings.
  5. Scroll down and find ‘External Tool Settings’.
  6. Download plink.exe and psftp.exe from the putty download site, and place them into c:\Program Files\iMC\ on the IMC server itself.
  7. Make sure the following fields are populated with the following info:
    SFTP Client:
    c:\Program Files\iMC\plink.exe
    
    SSH Client
    c:\Program Files\iMC\psftp.exe
  8. Navigate to Resource -> Batch Operation -> SSH Configuration.
  9. Add devices you want to access, then add the SSH information.

That’s it! Everything should work

Installing HP iMC – Intelligent Management Center

I have a single-server HP iMC deployment up and running. Here’s the process:

Overview

  1. Install and Configure the Prereqs (SQL, IIS for redirect, etc).
    1. SQL
    2. AD Bind User
    3. Web Server Certificate
    4. IIS for HTTP Redirection
  2. Install HP iMC.
  3. Configure a custom web server certificate.
  4. Integrate with LDAP and change the initial admin password.
  5. Redirect 80 & 443 to the actual web app’s ports.

Seems simple enough. Let’s get started!

Install and Configure the Prereqs

SQL Config

  • Install SQL and the latest SP’s and CU’s.
  • Enable Mixed-Mode and secure the SA account.
  • Enable TCP/IP.

SA Account

  1. Open SQL Server Management Studio -> right-click your db server -> properties.
  2. Click ‘Security’ then enable ‘SQL Server and Windows Authentication Mode’, then click OK to close the window.
  3. Next, expand the Security folder -> Logins.
  4. Right-click the ‘sa’ account and rename it to ‘sa-imc’ or something similar.
  5. Right-click the ‘sa-imc’ account and choose ‘Properties’.
  6. Change the sa account password.
  7. On the sa account properties page, click ‘status’ -> Enabled.

Enable TCP/IP

  1. Start -> Programs -> SQL Server 2008 -> Configuration Tools -> “SQL Configuration Manager”.
  2. SQL Server Network Configuration -> Protocols -> TCP/IP
  3. Enabled -> Yes
  4. IP Addresses -> 127.0.0.1 -> Enabled: Yes, OK to close the window.
  5. SQL Server Services -> SQL Server -> Right-click and ‘restart’.

AD Bind User

For this, you just need to create an account in AD for iMC to bind with. I recommend using a 64 character random password (at least). Also, I recommend limiting this account such that it cannot interactively login to workstations.

Once created, copy down the distinguishedName attribute. You’ll need this to configure AD integration in iMC.

Web Server Certificate

I wanted a PKI web server certificate for the HP iMC web app. That requires a couple things:

  1. Create a web server certificate template with an exportable key.
  2. Give the iMC server permission to enroll from that template.
  3. Deploy the template to one of your CA’s.
  4. Request the certificate

Creating and Deploying the Template

  1. On a CA, run ‘certtmpl.msc’ to open the Certificate Templates mmc snap-in.
  2. Right-click the ‘Web Server Certificate’ template then choose ‘Duplicate’.
  3. Choose ‘Windows Server 2003’ mode.
  4. Name the new certificate ‘HP iMC Web Server Certificate’.
  5. Under the ‘Request Handling’ tab, choose ‘Allow Private Key to be Exportable’. Also, I chose a key size of 2048.
  6. Under the ‘security’ tab, give the iMC computer account the following permissions: read, enroll.
  7. On your CA, run the ‘Certificate Authority’ snap-in -> Certificate Templates -> Add -> “HP iMC Web Server Certificate’.

Request the Certificate

  1. On your imc server, run ‘mmc’.
  2. Add the certificates snap-in targeted at the computer account.
  3. Navigate to the personal store, right-click -> Request New Certificate.
  4. Click next to select your AD policy, then check the box ‘HP iMC Web Server Certificate’
  5. Under the cert template we’re using, click Details -> Properties.
  6. Leave the ‘subject name’ box completely blank. Under ‘Alternative Subject Name’ add whatever DNS entries you’d like to use for this server.
  7. Under the ‘General’ tab, add a friendly name. It helps organize things quite a bit.
  8. Click OK, then next a couple times to request the cert. Congrats!

Exporting the Cert for use in iMC

HP iMC will not use the certificate by default, so you need to export the certificate with it’s private key. Later on in the process, we’ll convert the PKCS #12 key into a java keystore that HP iMC can accept.

  1. Open MMC -> Add the Certificates Snap-in, targeted at the computer account.
  2. Navigate to the Personal store.
  3. Right click the new Web Server Certificate -> Export.
  4. Export as a PKCS #12, and choose the box to export all certificates in the chain. I recommend using at least a 64 character password. Do NOT choose the box to delete the private key if the export is successful, or certificate will stop working.
  5. Save this file somewhere sensible, like C:\Build on the iMC server.

IIS for Redirection

I wanted to make the system easy for our network guys to access. To me, custom web application ports are difficult to remember — so I installed IIS to redirect all incoming traffic on 80 and 443 to the full https://fqdn:customPort location of iMC.

  1. Install the IIS role with only ‘HTTP Redirection’, logging, and anything else you feel that you need. You don’t need static content, ASP, etc.
  2. Open IIS Manager -> Default Site
  3. Right-click Default Site -> Bindings
  4. Edit the HTTPS binding and select the web server certificate that was requested earlier, then click OK to get back to IIS Manager.
  5. Click Default Site, then on the right-pane double-click “HTTP Redirection”.
  6. Check all three boxes, then for the target location enter:
    https://fqdn.organization.com:8443/imc
  7. Click Save, then exit IIS manager.

Install iMC

  1. Disable UAC and restart. I haven’t been able to get HP iMC working properly with UAC enabled. It’ll install if you run a command prompt as admin, but won’t start properly.
  2. Nagivate to your install media directory and double-click ‘start-install.bat’.
  3. Follow the instructions, using ‘sa-imc’ and the sa password to connect the the SQL server. Everything should just work.
  4. iMC does not automatically start running on boot. To enable auto-load on boot, open the iMC Agent and check the box “Automatically start the services when the OS starts.” You can also start the service immediately if desired.

Convert and Install the Web Server Certificate

The iMC web server is called jserver, which is a java-based web server. It requires a java compatible keystore for certificates. Also, HP iMC can only use a key with the name ‘imc’. To get everything correct we need to convert your PFX file to a java keystore, clone the keychain with a new name, then remove the original keychain with the default name.

  1. Open a command prompt and navigate to C:\Program Files\Java\jre14\bin.
  2. Run the following command to convert the PFX certificate chain exported earlier to a java keystore. It will display an ‘alias’ that looks something like -LongGUID. You’ll need this alias name in the next step.
    keytool.exe -importkeystore -srckeystore C:\build\hp-imc-webservercert-2012.pfx -destkeystore C:\build\keystore -srcstoretype pkcs12 -deststoretype JKS -storepass iMCV300R002 -v
  3. Run the following command to clone the long GUID name into the name ‘imc’ which the web application requires. For <GUID>, use the alias name given in the previous step.
    keytool -keyclone -keystore c:\build\keystore -alias le-hpimcwebserver-03afd524-5d34-4fd0-a2f0-84b1b982afa6 -dest imc
  4. This last command will remove the original alias name from the keystore.
    keytool -delete -keystore c:\build\keystore -alias le-hpimcwebserver-03afd524-5d34-4fd0-a2f0-84b1b982afa6
  5. Now, run the following commands to import the key:
    net stop "HP iMC Server"
    ren "C:\Program Files\iMC\client\security\keystore" "C:\Program Files\iMC\client\security\keystore.orig.bak"
    copy /y "C:\build\keystore" "C:\Program Files\iMC\client\security\"
    net stop "HP iMC Server"
  6. To restart the web server, open the iMC Agent, find the ‘Process’ tab, then restart the ‘jserver.exe’ process.

Change the Admin Password Integrate with LDAP

  1. Navigate to http://localhost. IIS should redirect you to the full https://fqdn/imc and you should _not_ get a certificate warning.
  2. Login as admin\admin.
  3. Click System -> Operator Management -> Operator.
  4. For the account ‘admin’ click ‘Modify’.
  5. Change the password!
  6. Click System -> Operator Management -> Authentication Server.
  7. Fill out the LDAP server information, then click ‘OK’. Make sure to choose ‘Microsoft Active Directory’ for server type. For ‘Admin DN’, enter the distinguishedName of the Bind User created earlier.

Alright! All the basics are now done. Enjoy!