CUCM node details via SSH and SSH credentials

What it is for

Through Details (SSH), EasyUC reads the state of a single CUCM node directly from its platform CLI: active and inactive version, hardware, IP configuration and DNS, and the status of the feature and network services. This helps when a node behaves oddly and you want to know whether a service is down or which version is actually active.

EasyUC connects to the node via SSH for this. Since version 4.8.3 the SSH credentials have to be stored separately. A CUCM platform/OS administrator is required, not the AXL user. The password is stored encrypted and never shown again.

On first contact EasyUC stores the SSH host key of the node. If the key changes later, EasyUC no longer connects and sends no password until an authorised person has checked and confirmed the new key.

Prerequisites

Licence module cucm.
To view: permission View CUCM node details (SSH) (ROLE_APP_CUCM_NODE_DETAILS).
To store, change, remove and test the credentials and to confirm a new host key: permission Change SSH credentials (ROLE_APP_CUCM_NODE_DETAILS_EDIT).
Administrators (ROLE_APP_ADMIN, ROLE_OWNER, ROLE_ADMIN, ROLE_SUPER_ADMIN) have both permissions. Helpdesk roles receive them only when they are assigned explicitly in the role editor.
Users without an administrator role see the details only for CUCM connections assigned to them.
A platform/OS administrator account of the CUCM. For IM&P nodes with their own OS administrator, different credentials can be stored per node.
EasyUC reaches the node via SSH (default port 22). The node name from the CUCM must be resolvable from EasyUC; otherwise enter an address.

Step by step: store SSH credentials

Select the CUCM connection in the header and open the Dashboard.
On the card of the CUCM node, click Details (SSH).
If no credentials are stored yet, click Enter SSH credentials. Otherwise open the dialog with SSH credentials.
Enter User name and Password of the OS administrator.
Under Applies to, choose either all nodes of this CUCM connection or this node only.
Click Test connection. On success, "Connection successful.", the active version and the SSH host key appear.
Click Save.
The detail page loads the node information. Refresh reads it again.

Step by step: confirm a changed host key or enter an address

If the detail page reports a changed key, click Review new key.
Compare the fingerprint under Now reported with the fingerprint you determined on the node itself.
Tick I have verified the new fingerprint through a trusted channel. and click Accept new key.
Then test the connection again.
If EasyUC cannot resolve the node name, click Address…, enter the address under IP address or host name and save.

Fields and options

Fields and options
Field / action	Meaning and use
User name / Password	CUCM platform/OS administrator. When changing: leave the password empty to keep the stored one.
Applies to	all nodes of this CUCM connection or this node only. Credentials for a single node take precedence.
Test connection	Establishes an SSH connection and shows active version and host key.
Remove credentials	Deletes the stored credentials. A single node then uses the credentials of the connection, if stored.
Address…	Manual IP address (IPv4 or IPv6) or resolvable host name of the node, without port and without `https://`. Applies to "Details (SSH)" and to the query of the CUCM Information tile. Reset uses the name from the CUCM again.
Accept new key	Replaces the stored SSH host key of the node with the one now reported.

How to read the detail page

How to read the detail page
Field / action	Meaning and use
Active Version / Inactive Version	Running software version of the node and the version of the inactive partition.
Hardware	Platform information on the (virtual) hardware.
IP Configuration & DNS	Network settings of the node.
Feature & Network Services	Per service the status as reported by the platform. "No services returned" means the query delivered no list.
SSH host	Address through which EasyUC reaches the node, with the addition "(entered manually)" for a stored address.
SSH host key	Fingerprint of the node with its origin: "stored on first contact on …" or "confirmed on … by …".
Credentials: …	Shows whether the credentials apply to all nodes of the connection or to this node only.

Check the result and narrow down errors

You recognise success when the detail page shows version, hardware, network and services.
"No SSH credentials are stored for this node." or, without the change permission, "Credentials missing – please ask an administrator …": store the credentials as described above.
"Login to the node was rejected – check the OS administrator's user name and password.": the AXL user was probably entered instead of the OS administrator, or the password is wrong.
"The node's SSH key has changed. For security reasons, no login was attempted.": normal after a reinstallation or restore of the node. Verify the fingerprint and accept the new key.
"The stored SSH credentials can no longer be read … and must be entered again.": occurs after a restore to a different instance. Enter the credentials again.
"The address of this node is new or has changed. For security reasons, EasyUC only sends the stored SSH password there once it has been entered again or successfully tested with the password for this address.": enter the password again in the dialog and test.
"The node cannot be reached via SSH.": check the firewall and the SSH port between EasyUC and the node.
"No secure SSH connection possible (key exchange failed).": EasyUC supports RSA host keys, as used by the CUCM. A target that offers only ECDSA or Ed25519 is rejected.
"The node name is a short name without a domain. Enter the IP address or the FQDN as the server name in the CUCM.": enter the address through Address… or correct the server name in the CUCM.
Every use of "Details (SSH)" and every change to credentials or host key is recorded in the audit log, without the password.