lithnet/ssh-managementagent

Lithnet FIM/MIM Linux/Unix SSH Management Agent

Lithnet FIM/MIM Linux/Unix SSH Management Agent

The Lithnet SSH MA is a ForeFront Identity Manager (FIM) ECMA2.2 management agent used to provision and synchronize objects to unix and linux systems using SSH

The management agent supports

• Full and (optionally) delta imports
• Exports (supporting either object replace, attribute replace, attribute update, or multivalued reference attribute update modes)
• Password set and change
• Username and RSA key-based logins, as well as username/password logins
• Dynamic DN construction

This MA requires ECMA2.2 which is supported in FIM 4.1.3441.0 and above

This management agent utilizes the RENCI SSH.NET library http://sshnet.codeplex.com/

System Requirements

The SSH Management agent requires MIM 2016, and .NET Framework 4.7.2.

Getting started

Download the management agent from the releases page Read the getting started guide

Getting support

Please open an issue, and provide a detailed description of the issue or question you'd like to ask.

Enterprise support

Lithnet offer enterprise support plans for our open-source products. Deploy our tools with confidence that you have the backing of the dedicated Lithnet support team if you run into any issues, have questions, or need advice. Simply fill out the request form, let us know the number of users you are managing with your MIM implementation, and we'll put together a quote.

Keep up to date

• Visit our blog
• Follow us on twitter

ssh-managementagent's Issues

Add support for multiple attributes in an optional declaration section

We had the following command definitions for user object-operation-ExportAdd and object-operation-ExportModify, respectively:

<command>/usr/bin/sudo /usr/sbin/useradd [-c "{comment},#{employeeID}#" ][-d {homeDirectory} ][-s {shell} ][-u {uid} ][-g {gid} ]{dn:$1}</command>

<command>/usr/bin/sudo /usr/sbin/usermod [-c "{comment},#{employeeID}#" ][-d {homeDirectory} ][-s {shell} ][-u {uid} ][-g {gid} ][-l {accountName} ]{dn:$1}</command>

But, for a new user, it looks like the comment attribute was being substituted but not the employeeID. And for a modify (updating the employeeID) it looks like the change to the employee wasn't being detected in terms of invoking the conditional "-c" option, and so the command was not executing with any options. I'm inferring (possibly incorrectly?) that only substitution is happening per optional section. Or... perhaps the # is breaking the substitution? (Is it a reserved character? Apologies if it is, but I missed it.) It feels like the above should work - so that if we're exporting a comment of "Firstname Lastname" and an employeeID of "1234567" we should see a user in the password file on the *nix machine with a comment field of "Firstname Lastname,#1234567#" - but we weren't. For the useradd we were seeing "Firstname Lastname,#{employeeID}#" and, as mentioned, the usermod was failing with a "no parameters" error.

Adam

abort command in Unix

Hi.

I use this Management Agent to create Oracle users in Unix servers. Instead of use unix command to create, modify or delete user, I create shell scripts that call to Oracle engina and execute Oracle commands to create, modify or delete Oracle Users.

My problem is: In some situations the script waits for inputo or confirmation after any error and I can not avoid this situation. Is it possible to configure any timeout in commands and after this time out, if the command didn't finish, kill the unix process and/or return an error code to MIM Synchronization?

Thanks in advanced
Kind regards

MAParameterValidator Doesn't Handle Configs in Extensions Folder Correctly

On line 54 of MAParameterValidator.cs, the File.Exists check does not look at the path variable. If the config file is in the Extensions folder (which appears to be supported otherwise), the validation fails.

Add Ability to Push MA Config Parameters in to Command Elements

It would be very helpful to be able to push the username and password config elements in to a to reuse them. For example, something like this:

someApp -u {sshma:username} -p {sshma:password} ...

Provide the ability to escape braces in declarations

There is currently no way to use literal braces in a declaration. A method of escaping them should be made available.

Log File Has No Line Breaks

Each line of the log doesn't have a line break so it all flows together.