Manual LCE Key Exchange
Required User Role: Administrator
You are not normally required to make a manual key exchange between Tenable.sc and the LCE; however, in some cases where you are prohibited from remote root login or required to do key exchange debugging, you must manually exchange the keys.
For the remote LCE to recognize Tenable.sc, copy the SSH public key of Tenable.sc and append it to the /opt/lce/.ssh/authorized_keys file. The
/opt/lce/daemons/lce-install-key.sh script performs this function.
Note: The LCE server must have a valid license key installed and the LCE daemon must be running before you perform the steps below.
To perform manual LCE key exchange:
Log in to Tenable.sc via the user interface.
- Download the Tenable.sc key, as described in Download the Tenable.sc SSH Key.
- Save the file locally as SSHKey.pub.
Caution: Do not edit the file or save it to any specific file type.
From the workstation where you downloaded the key file, use a secure copy program (e.g., WinSCP) to copy the SSHKey.pub file to the LCE system.
Note: You must have the credentials of an authorized user on the LCE server to perform this step.
For example, if you have a user username configured on the LCE server (hostname lceserver) whose home directory is /home/username, the command on a Unix system is as follows:
# scp SSHKey.pub [email protected]:/home/username
After you copy the file to the LCE server, In the CLI, run the following command to move the file to /opt/lce/daemons:
# mv /home/username/SSHKey.pub /opt/lce/daemons
On the LCE server, as the root user, run the following command to change the ownership of the SSH key file to lce:
# chown lce /opt/lce/daemons/SSHKey.pub
Run the following command to append the SSH public key to the /opt/lce/.ssh/authorized_keys file:
# su lce
# /opt/lce/daemons/lce-install-key.sh /opt/lce/daemons/SSHKey.pub
To test the communication, as the user tns on the Tenable.sc system, attempt to run the id command:
# su tns
# ssh -C -o PreferredAuthentications=publickey [email protected]<LCE-IP> id
If you have not previously established a connection, a warning appears that is similar to the following:
The authenticity of host '198.51.100.28 (198.51.100.28)' can't be established.
RSA key fingerprint is 86:63:b6:c3:b4:3b:ba:96:5c:b6:d4:42:b5:45:37:7f.
Are you sure you want to continue connecting (yes/no)?
- Answer yes to this prompt.
If the key exchange worked correctly, a message similar to the following appears:
# uid=251(lce) gid=251(lce) groups=251(lce)
- You can add the IP address of Tenable.sc to the LCE system’s /etc/hosts file. This prevents the SSH daemon from performing a DNS lookup that can add seconds to your query times.
- You can add the LCE to Tenable.sc via the normal administrator process, described in Log Correlation Engines.