Manual Key Exchange with Tenable.sc

A manual key exchange between Tenable.sc and the Log Correlation Engine is normally not required; however, in some cases where remote root login is prohibited or key exchange debugging is required, you will need to manually exchange the keys.

For the remote Log Correlation Engine to recognize Tenable.sc, you need to copy the SSH public key of Tenable.sc and append it to the /opt/lce/.ssh/authorized_keys file on the Log Correlation Engine server. The /opt/lce/daemons/lce-install-key.sh script performs this function.

Note: The Log Correlation Engine server must have a valid license key installed and the Log Correlation Engine daemon must be running before performing the steps below.

To manually exchange the keys with Tenable.sc:

  1. In Tenable.sc, download the Tenable.sc key, as described in Download the Tenable.sc SSH Key in the Tenable.sc User Guide. Both DSA and RSA formats work for this process.

  2. Save the key file (SSHKey.pub) to your local workstation. Do not edit the file or save it to any specific file type.

  3. From the workstation where you downloaded the key file, use a secure copy program, such as “scp” or “WinSCP” to copy the SSHKey.pub file to the Log Correlation Engine system. You will need to have the credentials of an authorized user on the LCE server to perform this step. For example, if you have a user “bob” configured on the Log Correlation Engine server (hostname “lceserver”) whose home directory is /home/bob, the command on a Linux or Unix system would be as follows:

    # scp SSHKey.pub :/home/bob

  4. After the file is copied to the Log Correlation Engine server, in the command line interface (CLI), run the following command to move the file to /opt/lce/daemons:

    # mv /home/bob/SSHKey.pub /opt/lce/daemons

  5. On the Log Correlation Engine server, as the root user, run the following command to change the ownership of the SSH key file to "lce":

    # chown lce /opt/lce/daemons/SSHKey.pub

  6. Run the following command to append the SSH public key to the “/opt/lce/.ssh/authorized_keys” file:

    # su lce

    # /opt/lce/daemons/lce-install-key.sh /opt/lce/daemons/SSHKey.pub

  7. To test the communication, as tns user on the Tenable.sc system, attempt to run the id command:

    # su tns

    # ssh -C -o PreferredAuthentications=publickey <LCE-IP> id

    • If a connection has not been previously established, you will see a warning similar to the following:

      The authenticity of host '192.168.15.82 (192.168.15.82)' can't be established. RSA key fingerprint is 86:63:b6:c3:b4:3b:ba:96:5c:b6:d4:42:b5:45:37:7f. Are you sure you want to continue connecting (yes/no)?

      Answer “yes” to this prompt.

    • If the key exchange worked correctly, a message similar to the following will be displayed:

      # uid=251(lce) gid=251(lce) groups=251(lce)

  8. You can add the IP address of Tenable.sc to the Log Correlation Engine system’s /etc/hosts file. This prevents the SSH daemon from performing a DNS lookup that can add seconds to your query times.

  9. Add the Log Correlation Engine to Tenable.sc, as described in Add a Log Correlation Engine Server in the Tenable.sc User Guide.